{"level":"error","ts":"2026-07-14T17:08:01.029Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:08:01.029Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:08:01.029Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","httpRouteRule":"rule-4","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route#rule-4"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"2f31ab98b72bd76794d30e18cc36295aaff67c4fafbeaf8255eebc5e84a1babd","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/auth-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["2f31ab98b72bd76794d30e18cc36295aaff67c4fafbeaf8255eebc5e84a1babd"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"2f31ab98b72bd76794d30e18cc36295aaff67c4fafbeaf8255eebc5e84a1babd\" already exists"}
{"level":"info","ts":"2026-07-14T17:08:01.032Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:08:01.130Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","httpRouteRule":"rule-5","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route#rule-5"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"c7e4523b72698ce91e84e0416f18b9c0f3203681a0e37faab4f2e6f5302c7e7b","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/auth-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["c7e4523b72698ce91e84e0416f18b9c0f3203681a0e37faab4f2e6f5302c7e7b"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"c7e4523b72698ce91e84e0416f18b9c0f3203681a0e37faab4f2e6f5302c7e7b\" already exists"}
{"level":"error","ts":"2026-07-14T17:08:01.229Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","httpRouteRule":"rule-7","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route#rule-7"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"1d612edb75fe5bc345a50cc6d34338c034ca1ead03a1a161258f103ac7adbe65","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/auth-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["1d612edb75fe5bc345a50cc6d34338c034ca1ead03a1a161258f103ac7adbe65"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"1d612edb75fe5bc345a50cc6d34338c034ca1ead03a1a161258f103ac7adbe65\" already exists"}
{"level":"error","ts":"2026-07-14T17:08:01.246Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","httpRouteRule":"rule-2","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route#rule-2"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"258d829c5d11af3ec6988fa9c3b6f40953d99ff8d2783ef88b17150a1f8c5e83","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/auth-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["258d829c5d11af3ec6988fa9c3b6f40953d99ff8d2783ef88b17150a1f8c5e83"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"258d829c5d11af3ec6988fa9c3b6f40953d99ff8d2783ef88b17150a1f8c5e83\" already exists"}
{"level":"error","ts":"2026-07-14T17:08:01.330Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","httpRouteRule":"rule-6","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route#rule-6"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"da88c44136af834574786500528283cef6329ed5227a11be867924bf40f78568","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/auth-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["da88c44136af834574786500528283cef6329ed5227a11be867924bf40f78568"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"da88c44136af834574786500528283cef6329ed5227a11be867924bf40f78568\" already exists"}
{"level":"error","ts":"2026-07-14T17:08:01.351Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","httpRouteRule":"rule-1","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route#rule-1"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"51e57514c7a0fd0cccbba463368047b5c2a53f4876abed48c66c8cd8361cf4b8","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/auth-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["51e57514c7a0fd0cccbba463368047b5c2a53f4876abed48c66c8cd8361cf4b8"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"51e57514c7a0fd0cccbba463368047b5c2a53f4876abed48c66c8cd8361cf4b8\" already exists"}
{"level":"error","ts":"2026-07-14T17:08:01.356Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-2f2de5","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T17:04:34Z","generation":10,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5ca13806-2430-4913-a271-7349ec6b6779\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:07:48Z"}],"name":"kuadrant-e2e-shared-a-2f2de5","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-2f2de5","uid":"5ca13806-2430-4913-a271-7349ec6b6779"}],"resourceVersion":"53567","uid":"c9385981-78ed-4089-abbf-f3383caf38d4"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2f31ab98b72bd76794d30e18cc36295aaff67c4fafbeaf8255eebc5e84a1babd","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"d66a051141424c316ea496a6a7fd4072d08193340610fd6de5842208bf15f7fc","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2f31ab98b72bd76794d30e18cc36295aaff67c4fafbeaf8255eebc5e84a1babd","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"7ce70d8dda69af6e3b322179bdfaaba6ae6f1223fff4b5c98e53b31d2a36c1b0","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"258d829c5d11af3ec6988fa9c3b6f40953d99ff8d2783ef88b17150a1f8c5e83","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"9490bd7a16e57b0e5775a903a1ff78b487ad8ba8930dbcb2323d0d9efc1c600a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"258d829c5d11af3ec6988fa9c3b6f40953d99ff8d2783ef88b17150a1f8c5e83","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"cfa70de541392268e022a4fea8c1fd1ecdf4a4a8cec9ee1cf8428f4736d9e001","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"da88c44136af834574786500528283cef6329ed5227a11be867924bf40f78568","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"bec578fb02afbce814a10d6957c5172e7991eef299ac90c22c140356389aa35a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"da88c44136af834574786500528283cef6329ed5227a11be867924bf40f78568","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"911af51f18c37de979292f8adb95800a9e8bbb54254e73e82bf00dac7713260d","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"3a6b300fd14935456848f159c43db8ee5dbe0a7a95ba1e1da9d96068317cc819","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"19a5c6c3c35196b55673a5d4f2c1c6a81673adc03a056d475cc8f2f1f676f215","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"51e57514c7a0fd0cccbba463368047b5c2a53f4876abed48c66c8cd8361cf4b8","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"0488b81615b985e557a6dce3a412d6b7d086af2366f7b1ad4b308f977bef014d","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"c7e4523b72698ce91e84e0416f18b9c0f3203681a0e37faab4f2e6f5302c7e7b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"6f5924609f378cd73fa0d1939838c93f7e1350c5afeb09c286f82edaa4cab1c8","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"1d612edb75fe5bc345a50cc6d34338c034ca1ead03a1a161258f103ac7adbe65","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"a97686414dff840e8be7a6cbd42fc79c122cc4a4c89b1f17d4f1556303f73db3","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"1feca843a0f8d5f1620c251bf0f1f53a63f00e10b2a86d8c528c85fc165cbe7b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"5bb6d9ce536333c775a9cd3d273d136c8acb961c1e2e62e53e84f1951c69db7b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"3f8493b3a03b2b8fe18245ce6684fb722879151307efef278d6f9223295e8681","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"df442cd23d165a096d28b984ae116caa27e7aa99f60a1224f23a293815b4cb82","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"b57d90abaa27481c772469969d20545017af7079c653272b4c7c0440c7253257","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-2f2de5"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-2f2de5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:08:01.371Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to create authconfig object","httpRoute":"ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route","httpRouteRule":"rule-8","authconfig":{"apiVersion":"authorino.kuadrant.io/v1beta3","kind":"AuthConfig","metadata":{"annotations":{"HTTPRouteRule.gateway.networking.k8s.io":"httproute.gateway.networking.k8s.io:ai-tenant-e2e-shared-a-2f2de5/sub-test-model-2f2de5-kserve-route#rule-8"},"creationTimestamp":null,"labels":{"kuadrant.io/auth":"true","kuadrant.io/managed":"true"},"name":"df442cd23d165a096d28b984ae116caa27e7aa99f60a1224f23a293815b4cb82","namespace":"kuadrant-system"},"spec":{"authentication":{"api-keys":{"credentials":{},"plain":{"selector":"request.headers.authorization"},"when":[{"operator":"matches","selector":"request.headers.authorization","value":"^Bearer **** sk-oai-\")"}]}},"authorization":{"auth-valid":{"cache":{"key":{"selector":"\"api-key|\" + (request.headers.authorization.replace(\"Bearer **** \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}"}},"require-group-membership":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2f2de5/auth-test-model-2f2de5\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n"}},"subscription-valid":{"cache":{"key":{"selector":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"opa":{"rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}"},"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]},"tenant-gateway-isolation":{"opa":{"rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }"}}},"hosts":["df442cd23d165a096d28b984ae116caa27e7aa99f60a1224f23a293815b4cb82"],"metadata":{"apiKeyValidation":{"cache":{"key":{"selector":"request.headers.authorization.replace(\"Bearer **** \"\")","value":null},"ttl":60},"http":{"body":{"expression":"{\"key\": request.headers.authorization.replace(\"Bearer **** \"\")}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate"},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.userId : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))) + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\") + \"|\" + ((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")) + \"|\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))","value":null},"ttl":60},"http":{"body":{"expression":"{\n  \"groups\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups),\n  \"username\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)),\n  \"requestedSubscription\": (has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\"),\n  \"requestedModel\": (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\"))\n}","value":null},"contentType":"application/json","credentials":{},"method":"POST","url":"https://maas-api-e2e-shared-a-2f2de5.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select"},"priority":1,"when":[{"predicate":"(size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" || \"x-gateway-model-name\" in request.headers)"}]}},"response":{"success":{"dynamicMetadata":{"identity":{"json":{"properties":{"groups":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)","value":null},"groups_str":{"expression":"((has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.groups : (has(auth.identity.groups) ? auth.identity.groups : auth.identity.user.groups)).join(\",\")","value":null},"keyId":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyId : \"\"","value":null},"keyName":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.keyName : \"\"","value":null},"selected_subscription":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"].name : \"\"","value":null},"selected_subscription_key":{"expression":"(has(auth.metadata[\"subscription-info\"].namespace) && has(auth.metadata[\"subscription-info\"].name)) ? auth.metadata[\"subscription-info\"].namespace + \"/\" + auth.metadata[\"subscription-info\"].name + \"@\" + (size(request.path.split(\"/\").filter(x, x != \"\")) >= 2 && request.path.split(\"/\").filter(x, x != \"\")[0] != \"v1\" && request.path.split(\"/\").filter(x, x != \"\")[0] != \"maas-api\" ? request.path.split(\"/\").filter(x, x != \"\")[0] + \"/\" + request.path.split(\"/\").filter(x, x != \"\")[1] : (\"x-gateway-model-name\" in request.headers   ? (request.headers[\"x-gateway-model-name\"].startsWith(\"publishers/\")     ? request.headers[\"x-gateway-model-name\"].split(\"/\")[1] + \"/\" + request.headers[\"x-gateway-model-name\"].split(\"/\")[3]     : request.headers[\"x-gateway-model-name\"])   : \"\")) : \"\"","value":null},"subscription_error":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"\"","value":null},"subscription_error_message":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"\"","value":null},"subscription_info":{"expression":"has(auth.metadata[\"subscription-info\"].name) ? auth.metadata[\"subscription-info\"] : {}","value":null},"userid":{"expression":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.username : (has(auth.identity.preferred_username) ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username))","value":null}}},"metrics":true}},"headers":{"X-MaaS-Group":{"plain":{"expression":"size(auth.metadata.apiKeyValidation.groups) > 0 ? '[\"' + auth.metadata.apiKeyValidation.groups.join('\",\"') + '\"]' : '[]'","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? (size(auth.identity.groups) > 0 && auth.identity.groups.all(g, g.matches('^[A-Za-z0-9:._/-]+$')) ? '[\"system:authenticated\",\"' + auth.identity.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]') : (has(auth.identity.user.groups) && size(auth.identity.user.groups) > 0 ? '[\"system:authenticated\",\"' + auth.identity.user.groups.join('\",\"') + '\"]' : '[\"system:authenticated\"]')","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** && has(auth.metadata.apiKeyValidation)) ? auth.metadata.apiKeyValidation.subscription : (\"x-maas-subscription\" in request.headers ? request.headers[\"x-maas-subscription\"] : \"\")","value":null},"when":[{"predicate":"(has(auth.metadata) && has(auth.metadata.apiKeyValidation) && auth.metadata.apiKeyValidation.subscription != \"\") || \"x-maas-subscription\" in request.headers"}]},"X-MaaS-Username":{"plain":{"selector":"auth.metadata.apiKeyValidation.username","value":null},"when":[{"predicate":"request.headers.authorization.matches(\"^Bearer **** ? auth.identity.preferred_username : (has(auth.identity.sub) ? auth.identity.sub : auth.identity.user.username)","value":null},"priority":1,"when":[{"predicate":"!request.headers.authorization.startsWith(\"Bearer **** required"}},"unauthorized":{"body":{"expression":"has(auth.metadata[\"subscription-info\"].message) ? auth.metadata[\"subscription-info\"].message : \"Access denied\"","value":null},"code":403,"headers":{"content-type":{"value":"text/plain"},"x-ext-auth-reason":{"expression":"has(auth.metadata[\"subscription-info\"].error) ? auth.metadata[\"subscription-info\"].error : \"unauthorized\"","value":null}}}}},"status":{"summary":{"festivalWristbandEnabled":false,"hostsReady":null,"numAuthorizationPolicies":0,"numHostsReady":"","numIdentitySources":0,"numMetadataSources":0,"numResponseItems":0,"ready":false}}},"error":"authconfigs.authorino.kuadrant.io \"df442cd23d165a096d28b984ae116caa27e7aa99f60a1224f23a293815b4cb82\" already exists"}
{"level":"error","ts":"2026-07-14T17:08:02.131Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-2f2de5-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-2f2de5-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:08:02.237Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-14T17:08:02.342Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-2f2de5-kserve-route","namespace":"ai-tenant-e2e-shared-a-2f2de5","uid":"e9723d47-3854-44e6-8b7a-a32969f51d1a","error":"Operation cannot be fulfilled on httproutes.gateway.networking.k8s.io \"sub-test-model-2f2de5-kserve-route\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:08:02.537Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:05.331Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","Limitador","ConfigMap","HTTPRoute","WasmPlugin"],"eventTypes":{"create":8,"update":5}}
{"level":"info","ts":"2026-07-14T17:08:05.347Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:05.431Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:08:05.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:08:05.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:06.138Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:08:06.138Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:06.138Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:06.240Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:06.638Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:08:06.739Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:08:06.739Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:08.143Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:08.638Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:10.042Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Limitador","TokenRateLimitPolicy","ConfigMap"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-07-14T17:08:10.149Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:10.233Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:08:10.429Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:08:10.430Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:10.829Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:10.838Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:08:10.838Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:10.929Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:10.929Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:11.129Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:08:11.131Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:08:12.858Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:13.332Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:35.736Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute","ConfigMap"],"eventTypes":{"create":1,"update":2}}
{"level":"info","ts":"2026-07-14T17:08:36.736Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:08:36.738Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:36.835Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:08:36.937Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:36.937Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:37.037Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:37.434Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:08:39.069Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:39.437Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:42.740Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","TokenRateLimitPolicy","AuthConfig","WasmPlugin","Limitador","ConfigMap","HTTPRoute"],"eventTypes":{"create":8,"update":9}}
{"level":"info","ts":"2026-07-14T17:08:42.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:43.032Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:08:43.230Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:08:43.230Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:43.829Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:43.829Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:43.841Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:44.138Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:08:44.140Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:08:44.140Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:44.433Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:08:45.971Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:46.642Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:48.047Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","Limitador","AuthPolicy"],"eventTypes":{"update":7}}
{"level":"info","ts":"2026-07-14T17:08:48.148Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:48.436Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:08:48.537Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:08:48.537Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:48.940Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:48.940Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:49.235Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:08:49.329Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:49.536Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:08:49.637Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:08:49.637Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:08:50.429Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-2f2de5-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-2f2de5-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:08:50.761Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-21db6d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-21db6d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:08:51.242Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:51.734Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:54.645Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","ConfigMap","TokenRateLimitPolicy"],"eventTypes":{"create":2,"update":3}}
{"level":"info","ts":"2026-07-14T17:08:55.530Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:55.530Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:08:55.641Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:08:55.739Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:08:56.236Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:08:56.440Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:00.336Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["HTTPRoute","AuthConfig","ConfigMap","AuthPolicy","Limitador","TokenRateLimitPolicy","WasmPlugin"],"eventTypes":{"update":34}}
{"level":"info","ts":"2026-07-14T17:09:00.357Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:00.730Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:09:00.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:09:00.830Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:01.141Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:01.329Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:01.329Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:01.835Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:01.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:09:01.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:01.938Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:09:03.436Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-21db6d","namespace":"ai-tenant-e2e-shared-b-21db6d","uid":"972fe131-d24f-4c7d-9f0c-d50742987ef9","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-21db6d\" not found"}
{"level":"error","ts":"2026-07-14T17:09:03.553Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-sub-test-model-2f2de5","namespace":"ai-tenant-e2e-shared-a-2f2de5","uid":"15284eea-cfc6-42c8-a454-b02a737147f2","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-sub-test-model-2f2de5\" not found"}
{"level":"info","ts":"2026-07-14T17:09:04.182Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:04.729Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:07.737Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["WasmPlugin","ConfigMap","AuthPolicy","TokenRateLimitPolicy","Limitador"],"eventTypes":{"delete":2,"update":8}}
{"level":"info","ts":"2026-07-14T17:09:07.758Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:07.835Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:09:08.030Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:09:08.030Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:08.642Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:08.642Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:08.829Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:08.830Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:09.230Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:09:09.241Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:09.438Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:10.844Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:11.732Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:14.739Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","WasmPlugin","HTTPRoute","ConfigMap"],"eventTypes":{"create":2,"update":10}}
{"level":"info","ts":"2026-07-14T17:09:14.759Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:14.929Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:09:15.130Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:09:15.130Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:15.729Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:15.729Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:15.829Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:15.939Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:15.939Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:09:16.032Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:09:16.238Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:09:16.238Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:17.950Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:18.539Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:22.939Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","WasmPlugin","HTTPRoute","ConfigMap"],"eventTypes":{"update":10}}
{"level":"info","ts":"2026-07-14T17:09:22.954Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:23.334Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:09:23.530Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:09:23.530Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:24.029Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:24.029Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:24.029Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:24.138Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:24.334Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:09:24.540Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:24.731Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:25.978Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-14T17:09:26.135Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-21db6d-kserve-route","namespace":"ai-tenant-e2e-shared-b-21db6d","uid":"f68e4330-ea5f-4a4c-8cb1-a00849571f72","error":"httproutes.gateway.networking.k8s.io \"sub-test-model-21db6d-kserve-route\" not found"}
{"level":"error","ts":"2026-07-14T17:09:26.239Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-21db6d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-21db6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:09:26.240Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:26.540Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","TokenRateLimitPolicy","HTTPRoute"],"eventTypes":{"delete":3,"update":1}}
{"level":"info","ts":"2026-07-14T17:09:27.529Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:27.533Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:27.539Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-14T17:09:27.632Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:09:27.632Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:09:27.638Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1d612edb75fe5bc345a50cc6d34338c034ca1ead03a1a161258f103ac7adbe65","error":"authconfigs.authorino.kuadrant.io \"1d612edb75fe5bc345a50cc6d34338c034ca1ead03a1a161258f103ac7adbe65\" not found"}
{"level":"info","ts":"2026-07-14T17:09:27.638Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:27.638Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-07-14T17:09:27.929Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/da88c44136af834574786500528283cef6329ed5227a11be867924bf40f78568","error":"authconfigs.authorino.kuadrant.io \"da88c44136af834574786500528283cef6329ed5227a11be867924bf40f78568\" not found"}
{"level":"error","ts":"2026-07-14T17:09:28.129Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2f31ab98b72bd76794d30e18cc36295aaff67c4fafbeaf8255eebc5e84a1babd","error":"authconfigs.authorino.kuadrant.io \"2f31ab98b72bd76794d30e18cc36295aaff67c4fafbeaf8255eebc5e84a1babd\" not found"}
{"level":"error","ts":"2026-07-14T17:09:28.241Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/258d829c5d11af3ec6988fa9c3b6f40953d99ff8d2783ef88b17150a1f8c5e83","error":"authconfigs.authorino.kuadrant.io \"258d829c5d11af3ec6988fa9c3b6f40953d99ff8d2783ef88b17150a1f8c5e83\" not found"}
{"level":"error","ts":"2026-07-14T17:09:28.434Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/51e57514c7a0fd0cccbba463368047b5c2a53f4876abed48c66c8cd8361cf4b8","error":"authconfigs.authorino.kuadrant.io \"51e57514c7a0fd0cccbba463368047b5c2a53f4876abed48c66c8cd8361cf4b8\" not found"}
{"level":"info","ts":"2026-07-14T17:09:28.438Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:09:28.531Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c7e4523b72698ce91e84e0416f18b9c0f3203681a0e37faab4f2e6f5302c7e7b","error":"authconfigs.authorino.kuadrant.io \"c7e4523b72698ce91e84e0416f18b9c0f3203681a0e37faab4f2e6f5302c7e7b\" not found"}
{"level":"error","ts":"2026-07-14T17:09:28.536Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/df442cd23d165a096d28b984ae116caa27e7aa99f60a1224f23a293815b4cb82","error":"authconfigs.authorino.kuadrant.io \"df442cd23d165a096d28b984ae116caa27e7aa99f60a1224f23a293815b4cb82\" not found"}
{"level":"error","ts":"2026-07-14T17:09:28.540Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3a6b300fd14935456848f159c43db8ee5dbe0a7a95ba1e1da9d96068317cc819","error":"authconfigs.authorino.kuadrant.io \"3a6b300fd14935456848f159c43db8ee5dbe0a7a95ba1e1da9d96068317cc819\" not found"}
{"level":"error","ts":"2026-07-14T17:09:28.541Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-2f2de5","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T17:04:34Z","generation":15,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5ca13806-2430-4913-a271-7349ec6b6779\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:09:16Z"}],"name":"kuadrant-e2e-shared-a-2f2de5","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-2f2de5","uid":"5ca13806-2430-4913-a271-7349ec6b6779"}],"resourceVersion":"54931","uid":"c9385981-78ed-4089-abbf-f3383caf38d4"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"1feca843a0f8d5f1620c251bf0f1f53a63f00e10b2a86d8c528c85fc165cbe7b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"5bb6d9ce536333c775a9cd3d273d136c8acb961c1e2e62e53e84f1951c69db7b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"3f8493b3a03b2b8fe18245ce6684fb722879151307efef278d6f9223295e8681","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-2f2de5"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-2f2de5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:09:28.557Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-21db6d","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T17:04:46Z","generation":19,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"242aae5c-c7a0-4e0f-ae4f-566239822840\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:09:16Z"}],"name":"kuadrant-e2e-shared-b-21db6d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-21db6d","uid":"242aae5c-c7a0-4e0f-ae4f-566239822840"}],"resourceVersion":"54929","uid":"04f77c3d-49c9-4655-b0dc-b772ce7e39fd"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8b75d19e2cb85496ed8e0f94e5d920f2d7380dc7deffbbfc125fd9c37ac1673d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"63f40a6af685c62996698729c16b229a876527d9cdf4cb5142a980a46ded4c6d","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"8b75d19e2cb85496ed8e0f94e5d920f2d7380dc7deffbbfc125fd9c37ac1673d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"e96d3152286ae4dde3ac1ddff60b652b2676b78e16b96ba7b69281efa913b28e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"bd01b0a147cd00c2783da2b6251f09708db89bc242f4f0b3d9d4907b613c7dcf","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"1aae20477ba1904e8668d6229b8885a1ba1afdea9da1b7a9737515ffbce529cb","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"bd01b0a147cd00c2783da2b6251f09708db89bc242f4f0b3d9d4907b613c7dcf","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"7852e5dd8a733143cf35e6157ee93533d9799d6e8309a5be7a9ea33cee4f5e1f","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e6545bad110eefa73efae3970959d9ad654cf9d68108732e7d2b3375de097f27","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"2677ad69b5cebf7e586081a3e0ba4aa5df54b7557b627fc7bc28cdedef68f30b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e6545bad110eefa73efae3970959d9ad654cf9d68108732e7d2b3375de097f27","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"de9f3a1487e016d8f7e7efd6a34ce42717b6dd63bfe56bd5a096f92767957d6d","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"9c8ec213408eb3d2b19f4c9be11c0be1621f7b02d3942f1c3b5afd52e0d85d8c","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"23f109702b4d4872086a6cb0cd71680b5d6689b116f8b280cc60bed53aa8d9e4","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"390b981486b6e5b0f797701fc39f253c126f4650bfce084607afbed00cfc630d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"75b2f83bf09e35319451436fc80f5362cdf2cc841c278231cc73a4f763bcd184","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"54a8bf80579643b0c71b2f7cde8fe148f7096abf3ffa6d115b499bfac9dc7323","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"b23c54ef52b5a1ef7323e1718e4cfd87afc0b12d25320a6dea013009add69532","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"b61fe6ffbbb5d0d5c8765d5b0debd4d12b96219200f521e58aa0f74dcddddf5c","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"ea182a3d42e97b50d10db15620f6a5ca7a68229011cb3ea4b89b9ac67b1f4a33","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"50898c9231ce1a73c327d10a380dd6ca851413f246a9446c890a031a2205de49","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"0e7d7b5d1f6e3aeb9858a548560edcbc76b84487c05dcc407ab64e8d2e7e3b3c","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"6c7a3456e989079a2c5134e88ebb793c8cc51db4250c7f28d6f3c3881f026b4d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"eea2b09113afcca7c8999a000a47c68e635a3a1b2f601718aa27a921af20f788","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"0572ba438e2d71b109ac11a2e05b3aa57dc46a68e4efb17a54c13074dae08650","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/sub-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"a133fa5dbec9b220c97d33b822a0f150fae268734400602fd9a7c57140ff3fe8","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-21db6d"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-21db6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:09:28.942Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-2f2de5","namespace":"openshift-ingress","uid":"5c4818dc-b383-4a32-a2d1-024daecbb15d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-2f2de5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:09:29.655Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-21db6d","namespace":"openshift-ingress","uid":"21201dca-b7c1-4fcd-9a3a-e5ab8d0fd0e0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-21db6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:09:29.689Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-14T17:09:29.742Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-21db6d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-21db6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:09:29.830Z","logger":"kuadrant-operator.HTTPRoutePolicyDiscoverabilityReconciler.reconcile","msg":"unable to update route status","name":"sub-test-model-21db6d-kserve-route","namespace":"ai-tenant-e2e-shared-b-21db6d","uid":"f68e4330-ea5f-4a4c-8cb1-a00849571f72","error":"httproutes.gateway.networking.k8s.io \"sub-test-model-21db6d-kserve-route\" not found"}
{"level":"info","ts":"2026-07-14T17:09:30.044Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:32.838Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","Limitador","ConfigMap","HTTPRoute","WasmPlugin","TokenRateLimitPolicy","AuthConfig"],"eventTypes":{"create":1,"delete":9,"update":8}}
{"level":"info","ts":"2026-07-14T17:09:32.855Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:33.134Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:09:33.430Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:09:33.430Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:33.829Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:34.041Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:34.041Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:34.136Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:09:34.337Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:34.337Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:09:34.430Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:09:34.430Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:36.089Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:36.540Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:39.333Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","AuthPolicy","HTTPRoute","WasmPlugin","ConfigMap","Limitador"],"eventTypes":{"create":8,"delete":8,"update":6}}
{"level":"info","ts":"2026-07-14T17:09:39.456Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:39.733Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:09:39.930Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:09:39.930Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:40.236Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:40.236Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:40.329Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:40.329Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:40.729Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:40.733Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:09:40.840Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:41.864Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:42.343Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:43.741Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Limitador","AuthPolicy","ConfigMap"],"eventTypes":{"update":3}}
{"level":"info","ts":"2026-07-14T17:09:43.843Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:43.931Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:09:44.129Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:09:44.130Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:44.441Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:44.441Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:44.529Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:44.630Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:44.639Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:09:44.639Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:44.642Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:46.345Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:46.840Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:48.148Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":15}}
{"level":"info","ts":"2026-07-14T17:09:48.331Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:48.532Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:09:48.730Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:09:48.730Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:48.837Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:48.929Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:48.929Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:49.037Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:49.232Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:09:49.232Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:50.346Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:50.832Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:56.439Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","HTTPRoute","Gateway","ConfigMap"],"eventTypes":{"create":1,"update":11}}
{"level":"info","ts":"2026-07-14T17:09:57.734Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:57.734Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:57.734Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:09:57.829Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:09:58.133Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:09:58.135Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:09:58.330Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:00.075Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:00.531Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:03.630Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","AuthConfig","Limitador","WasmPlugin","AuthPolicy","HTTPRoute"],"eventTypes":{"create":8,"update":9}}
{"level":"info","ts":"2026-07-14T17:10:03.648Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:03.737Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:10:04.030Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:10:04.030Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:04.540Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:04.540Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:04.540Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:04.642Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:04.739Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:04.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:10:04.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:10:06.347Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-b-21db6d-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-b-21db6d-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:06.467Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-2f2de5-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-2f2de5-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:10:06.745Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:07.546Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:09.033Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","AuthPolicy","Limitador","ConfigMap"],"eventTypes":{"create":2,"update":8}}
{"level":"info","ts":"2026-07-14T17:10:09.052Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:09.730Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:10:09.831Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:10:09.831Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:10.129Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:10.129Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:10.129Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:10.239Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:10.534Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:10:10.639Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:10.730Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:13.095Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:13.844Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:18.244Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthConfig","WasmPlugin","TokenRateLimitPolicy","HTTPRoute","ConfigMap","AuthPolicy","Limitador"],"eventTypes":{"update":34}}
{"level":"info","ts":"2026-07-14T17:10:18.261Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:18.339Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:10:18.530Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:10:18.530Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:19.229Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:19.229Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:19.329Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:19.340Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:10:19.434Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:19.834Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:10:19.834Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:10:19.834Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:21.397Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:21.937Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:22.131Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy"],"eventTypes":{"create":2,"delete":2}}
{"level":"info","ts":"2026-07-14T17:10:22.838Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:22.929Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:22.929Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:22.935Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-14T17:10:23.129Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:10:23.129Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:10:23.453Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-21db6d","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T17:04:46Z","generation":23,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"242aae5c-c7a0-4e0f-ae4f-566239822840\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:10:11Z"}],"name":"kuadrant-e2e-shared-b-21db6d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-21db6d","uid":"242aae5c-c7a0-4e0f-ae4f-566239822840"}],"resourceVersion":"55981","uid":"04f77c3d-49c9-4655-b0dc-b772ce7e39fd"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"db2bc998360d5d0d545999cae9a5c9506138be3bae098d12f62ff3b4df3f7d37","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]}],"name":"a2bd3a6bdfbb5612d8377fdf7d5acf4bfe03c0e32195bc884d4b8ad96a7e5297","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"db2bc998360d5d0d545999cae9a5c9506138be3bae098d12f62ff3b4df3f7d37","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]}],"name":"681888b821648cd435a4f4dde8f27d4f28dd916be9f3a0d0a0cc3c49607cb21e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]}],"name":"5cf9dfd56ad994d486e559c4858e27c8e09aaf71fdded0fab8cfaf7099cd221e","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]}],"name":"c88c49c6a477e214737eb5a3875684362713f2429e3f01b2b8b5d9b0190c13ec","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]}],"name":"cfa451e85b604837de202dc679e1493ef98c418d6420f6a7d6f93352543beab5","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]}],"name":"640de565254444cbf11782620f552764f80337aca7e43bedc77aa6097f94f0ff","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]}],"name":"04471c318a0ba06c866a9af665aa52e7d1bfdbf7a59f9f3a16288f76483a8041","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]}],"name":"47740ac3f17a87f9b5799642ee0891db4619975dc4682eb808c905ebe11bc0ef","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"bd1bd3a088db77c2f05d20faa40154cb94ff806f586bc202f5d9dd721e0f3ccd","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]}],"name":"afa4893f2428674c95c779a0b9cc31ff999154b2c8034d1dc4efa0a3d8eae9aa","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]}],"name":"e73df9a546625c1d797ede5524df80d301d0e4adc8708d821da6bc767970e43d","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"50898c9231ce1a73c327d10a380dd6ca851413f246a9446c890a031a2205de49","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"0e7d7b5d1f6e3aeb9858a548560edcbc76b84487c05dcc407ab64e8d2e7e3b3c","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"6c7a3456e989079a2c5134e88ebb793c8cc51db4250c7f28d6f3c3881f026b4d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"eea2b09113afcca7c8999a000a47c68e635a3a1b2f601718aa27a921af20f788","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_b_21db6d_e2e_rate_iso_b_2379b2_rate_test_model_21db6d_tokens__60f8214a","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-b-21db6d/e2e-rate-iso-b-2379b2@ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-b-21db6d/rate-test-model-21db6d-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-b-21db6d/maas-trlp-rate-test-model-21db6d"]}],"name":"46b49f3e22ffbaa6ee0b5b13b7fa7fe9ff92426bdf8cd86d06d6697a83753787","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-b-21db6d/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-21db6d"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-21db6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:23.550Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-2f2de5","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T17:04:34Z","generation":18,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"5ca13806-2430-4913-a271-7349ec6b6779\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:10:11Z"}],"name":"kuadrant-e2e-shared-a-2f2de5","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-a-2f2de5","uid":"5ca13806-2430-4913-a271-7349ec6b6779"}],"resourceVersion":"55968","uid":"c9385981-78ed-4089-abbf-f3383caf38d4"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]}],"name":"f132d717787f692160fc22038f2b6451552f9a417133cb96b3c08f55a383774a","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]}],"name":"f861be9d6f4c8607092dbaf13fcb2125369eff6516383a93416d9a0602078d36","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/chat/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"af34c5b19e8f266c7cd375db482d2b615d8945ba7291b9f168f422a85a1ec801","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]}],"name":"b9e3b7d3e1a270d1546fa8670716b77b546d5f9000123ff49c8d97521342eb8f","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"af34c5b19e8f266c7cd375db482d2b615d8945ba7291b9f168f422a85a1ec801","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]}],"name":"35dde1e9b29956ed76d9542fd40b590b36aeda35b45dc81e2499580586fd8fb6","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/completions'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"1402a46ce2613ebe09a5f5b710edc3b4972d440c7d3a76ff0c5cb8cb300bd2fd","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]}],"name":"c4c30b108f0e6d192526680e1717ba948e2ab27d15a4c389d0df5c2c3f7cc1c7","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses/'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"1402a46ce2613ebe09a5f5b710edc3b4972d440c7d3a76ff0c5cb8cb300bd2fd","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]}],"name":"a1b7f0aba4f9818f90b5454f3bcc02477a8c660c9689ffaef908594a345fd2b6","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path == '/v1/responses'","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]}],"name":"cff0428bcc7e472e66b962906d56217f16206e3063d5666c3f69286f084a4356","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/chat/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e3cffc85d4b765a8524537e199763c2c8dae7553840fe206faa2085ba4be44b3","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]}],"name":"bf67e0f11ede484cf867fac48f93e388624820f95d539620cad303db99cb2b60","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/completions')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"e8e11f407746823b968ea1e27d06b9c8c4ecb119439729a30e2044c2eb2c6981","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]}],"name":"048799c12ce8355068c53b028348b7e64980763500f2306c50424b2b7ef92c40","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5/v1/responses')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"c71fb7ad1d7f8d0a20942e9e648437951fae032b6ae661491d25e34756ce9232","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]}],"name":"453695bae3cd7d7aa08c6c17dec6a9ab1f1d33e0a8580e59f7172948dfd567a2","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"1feca843a0f8d5f1620c251bf0f1f53a63f00e10b2a86d8c528c85fc165cbe7b","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"5bb6d9ce536333c775a9cd3d273d136c8acb961c1e2e62e53e84f1951c69db7b","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__794a69d5","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-a-2f2de5-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-a-2f2de5"]}],"name":"3f8493b3a03b2b8fe18245ce6684fb722879151307efef278d6f9223295e8681","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-a-2f2de5-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.ai_tenant_e2e_shared_a_2f2de5_e2e_rate_iso_a_2379b2_rate_test_model_2f2de5_tokens__2f6840d8","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["auth.identity.selected_subscription_key == \"ai-tenant-e2e-shared-a-2f2de5/e2e-rate-iso-a-2379b2@ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5\" && !request.path.endsWith(\"/v1/models\")"]}],"scope":"ai-tenant-e2e-shared-a-2f2de5/rate-test-model-2f2de5-kserve-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:ai-tenant-e2e-shared-a-2f2de5/maas-trlp-rate-test-model-2f2de5"]}],"name":"62db86daf478d16f702b0f82c4fcd86d0e1ebd2fd2eef5eaa3f9e8d1d48b9285","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/')","request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h] == 'publishers/ai-tenant-e2e-shared-a-2f2de5/models/facebook/opt-125m')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-a-2f2de5"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-2f2de5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:24.038Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-2f2de5","namespace":"ai-tenant-e2e-shared-a-2f2de5","uid":"ed5d22e4-7e5f-4dd5-b70d-89d2ea62aa9b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-2f2de5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:24.239Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-21db6d","namespace":"ai-tenant-e2e-shared-b-21db6d","uid":"f401a79a-60ee-4fca-a33a-87ab6343d742","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-21db6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:10:27.430Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["WasmPlugin","TokenRateLimitPolicy","Limitador","ConfigMap","AuthPolicy"],"eventTypes":{"update":8}}
{"level":"info","ts":"2026-07-14T17:10:27.447Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:27.530Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:10:28.130Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:10:28.130Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:28.329Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:28.329Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:28.534Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:28.632Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:28.934Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:28.939Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:10:29.129Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:30.412Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:30.944Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:32.633Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","Limitador"],"eventTypes":{"update":2}}
{"level":"info","ts":"2026-07-14T17:10:32.647Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:32.832Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:10:33.031Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:10:33.031Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:33.442Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:33.536Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:33.539Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:10:33.539Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:10:34.343Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-2f2de5","namespace":"ai-tenant-e2e-shared-a-2f2de5","uid":"ed5d22e4-7e5f-4dd5-b70d-89d2ea62aa9b","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-2f2de5\" not found"}
{"level":"error","ts":"2026-07-14T17:10:34.445Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-rate-test-model-21db6d","namespace":"ai-tenant-e2e-shared-b-21db6d","uid":"f401a79a-60ee-4fca-a33a-87ab6343d742","error":"tokenratelimitpolicies.kuadrant.io \"maas-trlp-rate-test-model-21db6d\" not found"}
{"level":"info","ts":"2026-07-14T17:10:34.546Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:34.945Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:37.938Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Gateway","Limitador","HTTPRoute"],"eventTypes":{"delete":4,"update":15}}
{"level":"info","ts":"2026-07-14T17:10:37.953Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:38.036Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:10:38.230Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:10:38.230Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:39.036Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:39.036Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:39.040Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:39.229Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:39.439Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:10:39.533Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:39.534Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:40.758Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:41.029Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:41.135Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["Gateway","HTTPRoute"],"eventTypes":{"delete":1,"update":1}}
{"level":"info","ts":"2026-07-14T17:10:41.836Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:41.837Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:41.929Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:41.937Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"error","ts":"2026-07-14T17:10:42.033Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"failed to update limitador object","error":"Operation cannot be fulfilled on limitadors.limitador.kuadrant.io \"limitador\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:10:42.033Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"error","ts":"2026-07-14T17:10:42.229Z","logger":"kuadrant-operator.IstioAuthClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-auth-e2e-shared-a-2f2de5","error":"envoyfilters.networking.istio.io \"kuadrant-auth-e2e-shared-a-2f2de5\" not found"}
{"level":"info","ts":"2026-07-14T17:10:42.230Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:42.330Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"error","ts":"2026-07-14T17:10:42.430Z","logger":"kuadrant-operator.IstioRateLimitClusterReconciler","msg":"failed to delete envoyfilter object","envoyfilter":"openshift-ingress/kuadrant-ratelimiting-e2e-shared-a-2f2de5","error":"envoyfilters.networking.istio.io \"kuadrant-ratelimiting-e2e-shared-a-2f2de5\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.529Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e3cffc85d4b765a8524537e199763c2c8dae7553840fe206faa2085ba4be44b3","error":"authconfigs.authorino.kuadrant.io \"e3cffc85d4b765a8524537e199763c2c8dae7553840fe206faa2085ba4be44b3\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.537Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/1402a46ce2613ebe09a5f5b710edc3b4972d440c7d3a76ff0c5cb8cb300bd2fd","error":"authconfigs.authorino.kuadrant.io \"1402a46ce2613ebe09a5f5b710edc3b4972d440c7d3a76ff0c5cb8cb300bd2fd\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.541Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/af34c5b19e8f266c7cd375db482d2b615d8945ba7291b9f168f422a85a1ec801","error":"authconfigs.authorino.kuadrant.io \"af34c5b19e8f266c7cd375db482d2b615d8945ba7291b9f168f422a85a1ec801\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.629Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb","error":"authconfigs.authorino.kuadrant.io \"958a8c3cf55c0d34e2615f182c8dc700c4a5a42725a2089c2ecebbb8bcedb0eb\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.633Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/e8e11f407746823b968ea1e27d06b9c8c4ecb119439729a30e2044c2eb2c6981","error":"authconfigs.authorino.kuadrant.io \"e8e11f407746823b968ea1e27d06b9c8c4ecb119439729a30e2044c2eb2c6981\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.636Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02","error":"authconfigs.authorino.kuadrant.io \"3c0464b4db5421b41a5ff5f6b36b368eb7e3f10795411b4832f8372a757eba02\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.640Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee","error":"authconfigs.authorino.kuadrant.io \"5f26f5ffad4be06c5d4cefb7ba129f0b9ff920751646ea06107011c4b9fb04ee\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.644Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/db2bc998360d5d0d545999cae9a5c9506138be3bae098d12f62ff3b4df3f7d37","error":"authconfigs.authorino.kuadrant.io \"db2bc998360d5d0d545999cae9a5c9506138be3bae098d12f62ff3b4df3f7d37\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.647Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to update wasmplugin object","gateway":"openshift-ingress/e2e-shared-b-21db6d","wasmplugin":{"apiVersion":"extensions.istio.io/v1alpha1","kind":"WasmPlugin","metadata":{"creationTimestamp":"2026-07-14T17:04:46Z","generation":24,"labels":{"kuadrant.io/managed":"true"},"managedFields":[{"apiVersion":"extensions.istio.io/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:kuadrant.io/managed":{}},"f:ownerReferences":{".":{},"k:{\"uid\":\"242aae5c-c7a0-4e0f-ae4f-566239822840\"}":{}}},"f:spec":{".":{},"f:phase":{},"f:pluginConfig":{".":{},"f:actionSets":{},"f:services":{".":{},"f:auth-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-check-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-report-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}},"f:ratelimit-service":{".":{},"f:endpoint":{},"f:failureMode":{},"f:timeout":{},"f:type":{}}}},"f:targetRefs":{},"f:url":{}}},"manager":"manager","operation":"Update","time":"2026-07-14T17:10:20Z"}],"name":"kuadrant-e2e-shared-b-21db6d","namespace":"openshift-ingress","ownerReferences":[{"apiVersion":"gateway.networking.k8s.io/v1","blockOwnerDeletion":true,"controller":true,"kind":"Gateway","name":"e2e-shared-b-21db6d","uid":"242aae5c-c7a0-4e0f-ae4f-566239822840"}],"resourceVersion":"56133","uid":"04f77c3d-49c9-4655-b0dc-b772ce7e39fd"},"spec":{"phase":"STATS","pluginConfig":{"actionSets":[{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"50898c9231ce1a73c327d10a380dd6ca851413f246a9446c890a031a2205de49","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"0e7d7b5d1f6e3aeb9858a548560edcbc76b84487c05dcc407ab64e8d2e7e3b3c","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/v1/models')"]}},{"actions":[{"predicates":["request.path != \"/maas-api/health\" || request.method != \"GET\""],"scope":"6c7a3456e989079a2c5134e88ebb793c8cc51db4250c7f28d6f3c3881f026b4d","service":"auth-service","sources":["authpolicy.kuadrant.io:openshift-ingress/e2e-shared-b-21db6d-maas-auth"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"0"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-check-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]},{"conditionalData":[{"data":[{"expression":{"key":"tokenlimit.deny_all_by_default__833681f6","value":"1"}},{"expression":{"key":"auth.identity.userid","value":"auth.identity.userid"}},{"expression":{"key":"ratelimit.hits_addend","value":"responseBodyJSON(\"/usage/total_tokens\")"}}],"predicates":["!request.path.startsWith(\"/maas-api\") && !request.path.startsWith(\"/v1/models\")"]}],"scope":"opendatahub/maas-api-e2e-shared-b-21db6d-route","service":"ratelimit-report-service","sources":["tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny-e2e-shared-b-21db6d"]}],"name":"eea2b09113afcca7c8999a000a47c68e635a3a1b2f601718aa27a921af20f788","routeRuleConditions":{"hostnames":["*"],"predicates":["request.url_path.startsWith('/maas-api')"]}}],"services":{"auth-service":{"endpoint":"kuadrant-auth-service","failureMode":"deny","timeout":"200ms","type":"auth"},"ratelimit-check-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-check"},"ratelimit-report-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"deny","timeout":"100ms","type":"ratelimit-report"},"ratelimit-service":{"endpoint":"kuadrant-ratelimit-service","failureMode":"allow","timeout":"100ms","type":"ratelimit"}}},"targetRefs":[{"group":"gateway.networking.k8s.io","kind":"Gateway","name":"e2e-shared-b-21db6d"}],"url":"quay.io/kuadrant/wasm-shim:v0.12.1"},"status":{}},"error":"Operation cannot be fulfilled on wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-b-21db6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:42.648Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2","error":"authconfigs.authorino.kuadrant.io \"923781ebe5a565407abfa33659ba6de25b45ee090f3a12b3583a7c276391a3b2\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.729Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146","error":"authconfigs.authorino.kuadrant.io \"353758c799afc93ec1731b1c78b1897c68dd37d36093dfe4c12f7ae5bbe27146\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.733Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54","error":"authconfigs.authorino.kuadrant.io \"a8f909e41b1b87af176bef39f0e05bffe4aff02eee3280d29766c6322427fd54\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.739Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/c71fb7ad1d7f8d0a20942e9e648437951fae032b6ae661491d25e34756ce9232","error":"authconfigs.authorino.kuadrant.io \"c71fb7ad1d7f8d0a20942e9e648437951fae032b6ae661491d25e34756ce9232\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.742Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/bd1bd3a088db77c2f05d20faa40154cb94ff806f586bc202f5d9dd721e0f3ccd","error":"authconfigs.authorino.kuadrant.io \"bd1bd3a088db77c2f05d20faa40154cb94ff806f586bc202f5d9dd721e0f3ccd\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.746Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4","error":"authconfigs.authorino.kuadrant.io \"ec95616c0099f2cd714fdc5dc840f003dfa607c4020099307495589a6b46a8f4\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.748Z","logger":"kuadrant-operator.IstioExtensionReconciler","msg":"failed to delete wasmplugin object","gateway":"openshift-ingress/e2e-shared-a-2f2de5","wasmplugin":"openshift-ingress/kuadrant-e2e-shared-a-2f2de5","error":"wasmplugins.extensions.istio.io \"kuadrant-e2e-shared-a-2f2de5\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.749Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869","error":"authconfigs.authorino.kuadrant.io \"7ef7731de46175be3ba869167a82d293f1ed58341f5bea4a41038b1ed6393869\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.755Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7","error":"authconfigs.authorino.kuadrant.io \"7b5ef911e218b466fa34e5eb24b289be9e7e51098438c95895a3bcaa99104bd7\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.761Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee","error":"authconfigs.authorino.kuadrant.io \"2effb9233dcc431132b9a0495308946474d81723d70b7fa0a97b19ba958e9eee\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.764Z","logger":"kuadrant-operator.AuthConfigsReconciler","msg":"failed to delete authconfig object","authconfig":"kuadrant-system/5bb6d9ce536333c775a9cd3d273d136c8acb961c1e2e62e53e84f1951c69db7b","error":"authconfigs.authorino.kuadrant.io \"5bb6d9ce536333c775a9cd3d273d136c8acb961c1e2e62e53e84f1951c69db7b\" not found"}
{"level":"error","ts":"2026-07-14T17:10:42.829Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ait-47ef20f4","namespace":"openshift-ingress","uid":"03955b0c-ce67-4ba0-94d7-a85026cb1556","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ait-47ef20f4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:42.845Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"014aa6fe-efa9-44b2-854f-d84db7f097f4","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:42.849Z","logger":"kuadrant-operator.AuthPolicyStatusUpdater","msg":"unable to update status for authpolicy","name":"e2e-shared-a-2f2de5-maas-auth","namespace":"openshift-ingress","error":"Operation cannot be fulfilled on authpolicies.kuadrant.io \"e2e-shared-a-2f2de5-maas-auth\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:42.942Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"94063e86-caf7-46d9-980b-e58a4dd69550","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:43.057Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-b-3a7c08","namespace":"openshift-ingress","uid":"254d210b-0d67-4657-8466-c8595fb99fe1","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-b-3a7c08\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:43.071Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-5d77ea9b","namespace":"openshift-ingress","uid":"cd8a0f8b-6f00-436c-81ae-07b57aa0fc49","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-5d77ea9b\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:43.338Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-21db6d","namespace":"openshift-ingress","uid":"21201dca-b7c1-4fcd-9a3a-e5ab8d0fd0e0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-21db6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:43.429Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-derive-07afec54","namespace":"openshift-ingress","uid":"b8e93124-c2f9-4c21-906b-80c45d84f3f4","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-derive-07afec54\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:43.436Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-b-845e65","namespace":"openshift-ingress","uid":"30c161b3-0f79-4fa7-8e90-4ed7f579132a","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-b-845e65\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:43.442Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-inf-a-1c66bf","namespace":"openshift-ingress","uid":"8d021b7c-de5e-4b28-afec-660de874fdf1","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-inf-a-1c66bf\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:43.448Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-api-a-417196","namespace":"openshift-ingress","uid":"a4f1835c-b0bd-4b74-b879-99e08eb359d3","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-api-a-417196\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:43.455Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-ait-def21b00","namespace":"openshift-ingress","uid":"09a218f2-cce3-4b6d-ac35-7d10410f3b9b","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-ait-def21b00\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:43.462Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-mt-4f8cd5c4","namespace":"openshift-ingress","uid":"367a587c-0f90-40af-ae0d-641385eaf2c7","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-mt-4f8cd5c4\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:10:43.540Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-a-2f2de5","namespace":"openshift-ingress","uid":"5c4818dc-b383-4a32-a2d1-024daecbb15d","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-a-2f2de5\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:10:43.540Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:43.747Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:46.234Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","WasmPlugin","Limitador","AuthPolicy","AuthConfig","EnvoyFilter"],"eventTypes":{"delete":21,"update":17}}
{"level":"info","ts":"2026-07-14T17:10:46.256Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:46.333Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:10:46.530Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:10:46.530Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:46.637Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:46.834Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:46.839Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:46.839Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:46.937Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:10:46.937Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:47.134Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:48.257Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:48.441Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:49.744Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","Limitador","ConfigMap"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-07-14T17:10:49.766Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:49.842Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:10:50.230Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:10:50.230Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:50.537Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:50.629Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:50.629Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:50.630Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:10:50.630Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:10:50.730Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:10:51.379Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:10:51.730Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:20.434Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","AuthPolicy","Gateway"],"eventTypes":{"delete":2,"update":1}}
{"level":"info","ts":"2026-07-14T17:11:20.838Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:11:20.929Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:21.030Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:21.229Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:21.333Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:11:21.333Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:21.333Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:11:22.158Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"error","ts":"2026-07-14T17:11:22.241Z","logger":"kuadrant-operator.GatewayPolicyDiscoverabilityReconciler.reconcile","msg":"failed to update gateway status","gateway":"e2e-shared-b-21db6d","error":"Operation cannot be fulfilled on gateways.gateway.networking.k8s.io \"e2e-shared-b-21db6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:11:22.334Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:23.542Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Gateway","HTTPRoute"],"eventTypes":{"delete":1,"update":3}}
{"level":"info","ts":"2026-07-14T17:11:24.129Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:24.233Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"updating limitador object","status":"processing"}
{"level":"info","ts":"2026-07-14T17:11:24.235Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:11:24.238Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:24.238Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:24.430Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:24.435Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:11:25.233Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:25.431Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:28.533Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["ConfigMap","TokenRateLimitPolicy","Limitador","AuthPolicy","WasmPlugin","EnvoyFilter","AuthConfig"],"eventTypes":{"delete":5,"update":6}}
{"level":"info","ts":"2026-07-14T17:11:28.549Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:28.630Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:11:29.029Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:11:29.030Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:29.035Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:29.231Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:11:29.231Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:29.234Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:11:29.234Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:29.234Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:29.438Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:11:30.176Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:30.529Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:30.549Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["AuthPolicy","Gateway"],"eventTypes":{"delete":2}}
{"level":"info","ts":"2026-07-14T17:11:31.029Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:31.038Z","logger":"kuadrant-operator.AuthorinoIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"authorino","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:11:31.135Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:11:31.135Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:31.139Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:11:31.139Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:31.139Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"error","ts":"2026-07-14T17:11:31.652Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"gateway-default-deny-e2e-shared-b-21db6d","namespace":"openshift-ingress","uid":"21201dca-b7c1-4fcd-9a3a-e5ab8d0fd0e0","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"gateway-default-deny-e2e-shared-b-21db6d\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:11:31.839Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-facebook-opt-125m-simulated","namespace":"llm","uid":"014aa6fe-efa9-44b2-854f-d84db7f097f4","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-facebook-opt-125m-simulated\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"error","ts":"2026-07-14T17:11:31.969Z","logger":"kuadrant-operator.TokenRateLimitPolicyStatusUpdater","msg":"unable to update policy status","name":"maas-trlp-premium-simulated-simulated-premium","namespace":"llm","uid":"94063e86-caf7-46d9-980b-e58a4dd69550","error":"Operation cannot be fulfilled on tokenratelimitpolicies.kuadrant.io \"maas-trlp-premium-simulated-simulated-premium\": the object has been modified; please apply your changes to the latest version and try again"}
{"level":"info","ts":"2026-07-14T17:11:31.978Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:32.133Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:33.334Z","logger":"kuadrant-operator.event logger","msg":"new events","resources":["TokenRateLimitPolicy","ConfigMap","Limitador"],"eventTypes":{"update":5}}
{"level":"info","ts":"2026-07-14T17:11:33.430Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:33.434Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"applying limitador resource"}
{"level":"info","ts":"2026-07-14T17:11:33.630Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"limitador resource applied successfully"}
{"level":"info","ts":"2026-07-14T17:11:33.631Z","logger":"kuadrant-operator.LimitadorResourceReconciler","msg":"reconciling limitador resource","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:33.640Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:33.829Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:33.829Z","logger":"kuadrant-operator.IstioExtensionReconciler.buildWasmConfigs","msg":"build Wasm configuration","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:33.939Z","logger":"kuadrant-operator.LimitadorIstioIntegrationReconciler","msg":"get object","kind":"v1.Deployment","name":"limitador-limitador","namespace":"kuadrant-system"}
{"level":"info","ts":"2026-07-14T17:11:34.030Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"limitador object is up to date, nothing to do","status":"skipping"}
{"level":"info","ts":"2026-07-14T17:11:34.030Z","logger":"kuadrant-operator.LimitadorLimitsReconciler","msg":"Limitador limits reconciler","status":"completed"}
{"level":"info","ts":"2026-07-14T17:11:34.513Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"started"}
{"level":"info","ts":"2026-07-14T17:11:34.637Z","logger":"kuadrant-operator.KuadrantStatusUpdater","msg":"reconciling kuadrant status","status":"completed"}