{"level":"info","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:50172","PortSpecifier":{"PortValue":50172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:50172","PortSpecifier":{"PortValue":50172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160840,"nanos":326718159},"http":{"id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu"}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu\"}"}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","subscription":"e2e-rate-iso-a-0dc4e2","tenant":"e2e-shared-a-ef3a1a","userId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-0dc4e2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0dc4e2"}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","selected_subscription":"e2e-rate-iso-a-0dc4e2","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-0dc4e2@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53b572bc-643e-423b-9252-f5e89c2d9ecd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5204660e-b738-47bf-8585-368d37193e73","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:50182","PortSpecifier":{"PortValue":50182}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5204660e-b738-47bf-8585-368d37193e73","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5204660e-b738-47bf-8585-368d37193e73","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:50182","PortSpecifier":{"PortValue":50182}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160841,"nanos":366163409},"http":{"id":"5204660e-b738-47bf-8585-368d37193e73","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5204660e-b738-47bf-8585-368d37193e73","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu"}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5204660e-b738-47bf-8585-368d37193e73","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu\"}"}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5204660e-b738-47bf-8585-368d37193e73","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","subscription":"e2e-rate-iso-a-0dc4e2","tenant":"e2e-shared-a-ef3a1a","userId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5204660e-b738-47bf-8585-368d37193e73","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-0dc4e2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5204660e-b738-47bf-8585-368d37193e73","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5204660e-b738-47bf-8585-368d37193e73","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5204660e-b738-47bf-8585-368d37193e73","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5204660e-b738-47bf-8585-368d37193e73","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5204660e-b738-47bf-8585-368d37193e73","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5204660e-b738-47bf-8585-368d37193e73","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5204660e-b738-47bf-8585-368d37193e73","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5204660e-b738-47bf-8585-368d37193e73","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5204660e-b738-47bf-8585-368d37193e73","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0dc4e2"}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5204660e-b738-47bf-8585-368d37193e73","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","selected_subscription":"e2e-rate-iso-a-0dc4e2","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-0dc4e2@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5204660e-b738-47bf-8585-368d37193e73","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5204660e-b738-47bf-8585-368d37193e73","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:50186","PortSpecifier":{"PortValue":50186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ecc53394-f84d-46ac-9886-87dbf762fb27","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:50186","PortSpecifier":{"PortValue":50186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160842,"nanos":400666363},"http":{"id":"ecc53394-f84d-46ac-9886-87dbf762fb27","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu"}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu\"}"}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","subscription":"e2e-rate-iso-a-0dc4e2","tenant":"e2e-shared-a-ef3a1a","userId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-0dc4e2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0dc4e2"}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","selected_subscription":"e2e-rate-iso-a-0dc4e2","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-0dc4e2@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ecc53394-f84d-46ac-9886-87dbf762fb27","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:50188","PortSpecifier":{"PortValue":50188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:50188","PortSpecifier":{"PortValue":50188}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160843,"nanos":437034826},"http":{"id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu"}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu\"}"}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","subscription":"e2e-rate-iso-a-0dc4e2","tenant":"e2e-shared-a-ef3a1a","userId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-0dc4e2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0dc4e2"}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","selected_subscription":"e2e-rate-iso-a-0dc4e2","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-0dc4e2@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"22aeb452-8d88-478a-ac9d-6001a6dc9706","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46550","PortSpecifier":{"PortValue":46550}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f891b094-889a-40bc-8738-8f222d1e0e96","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46550","PortSpecifier":{"PortValue":46550}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160844,"nanos":474047451},"http":{"id":"f891b094-889a-40bc-8738-8f222d1e0e96","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu"}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu\"}"}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","subscription":"e2e-rate-iso-a-0dc4e2","tenant":"e2e-shared-a-ef3a1a","userId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-0dc4e2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0dc4e2"}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","selected_subscription":"e2e-rate-iso-a-0dc4e2","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-0dc4e2@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f891b094-889a-40bc-8738-8f222d1e0e96","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46552","PortSpecifier":{"PortValue":46552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"98676f02-7542-475c-8abe-930f01ceb4f2","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46552","PortSpecifier":{"PortValue":46552}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160845,"nanos":509487000},"http":{"id":"98676f02-7542-475c-8abe-930f01ceb4f2","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu"}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu\"}"}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","subscription":"e2e-rate-iso-a-0dc4e2","tenant":"e2e-shared-a-ef3a1a","userId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-0dc4e2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0dc4e2"}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","selected_subscription":"e2e-rate-iso-a-0dc4e2","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-0dc4e2@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98676f02-7542-475c-8abe-930f01ceb4f2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46568","PortSpecifier":{"PortValue":46568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ab004756-e569-4f2e-af11-f2fd20adc71a","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46568","PortSpecifier":{"PortValue":46568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160846,"nanos":551492403},"http":{"id":"ab004756-e569-4f2e-af11-f2fd20adc71a","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu"}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu\"}"}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","subscription":"e2e-rate-iso-a-0dc4e2","tenant":"e2e-shared-a-ef3a1a","userId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-0dc4e2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0dc4e2"}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","selected_subscription":"e2e-rate-iso-a-0dc4e2","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-0dc4e2@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ab004756-e569-4f2e-af11-f2fd20adc71a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6961f94c-1545-450a-8f3b-18aa95979309","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46572","PortSpecifier":{"PortValue":46572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6961f94c-1545-450a-8f3b-18aa95979309","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6961f94c-1545-450a-8f3b-18aa95979309","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46572","PortSpecifier":{"PortValue":46572}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160847,"nanos":584220281},"http":{"id":"6961f94c-1545-450a-8f3b-18aa95979309","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu"}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu\"}"}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","subscription":"e2e-rate-iso-a-0dc4e2","tenant":"e2e-shared-a-ef3a1a","userId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-0dc4e2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6961f94c-1545-450a-8f3b-18aa95979309","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0dc4e2"}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6961f94c-1545-450a-8f3b-18aa95979309","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","selected_subscription":"e2e-rate-iso-a-0dc4e2","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-0dc4e2@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6961f94c-1545-450a-8f3b-18aa95979309","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6961f94c-1545-450a-8f3b-18aa95979309","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46586","PortSpecifier":{"PortValue":46586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46586","PortSpecifier":{"PortValue":46586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160848,"nanos":621761813},"http":{"id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu"}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu\"}"}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","subscription":"e2e-rate-iso-a-0dc4e2","tenant":"e2e-shared-a-ef3a1a","userId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-0dc4e2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0dc4e2"}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","selected_subscription":"e2e-rate-iso-a-0dc4e2","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-0dc4e2@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b4bc75e-edcb-44ac-a690-0f84593cc623","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46598","PortSpecifier":{"PortValue":46598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46598","PortSpecifier":{"PortValue":46598}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160849,"nanos":658006655},"http":{"id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu"}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu\"}"}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","subscription":"e2e-rate-iso-a-0dc4e2","tenant":"e2e-shared-a-ef3a1a","userId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-0dc4e2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0dc4e2"}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","selected_subscription":"e2e-rate-iso-a-0dc4e2","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-0dc4e2@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef1c06fe-44e7-451b-b6b4-6b0f9f103b9b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f0553418-6d53-40de-84b0-141ee67891dc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46608","PortSpecifier":{"PortValue":46608}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f0553418-6d53-40de-84b0-141ee67891dc","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f0553418-6d53-40de-84b0-141ee67891dc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:46608","PortSpecifier":{"PortValue":46608}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160850,"nanos":691051931},"http":{"id":"f0553418-6d53-40de-84b0-141ee67891dc","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu"}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1e0pm4XiInSb8wBSG_c937gpjvrW40Imbu56TTxiRTPzMesn7uH7emRNszFEu\"}"}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","subscription":"e2e-rate-iso-a-0dc4e2","tenant":"e2e-shared-a-ef3a1a","userId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-0dc4e2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f0553418-6d53-40de-84b0-141ee67891dc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0dc4e2"}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f0553418-6d53-40de-84b0-141ee67891dc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b5a5ddfa-e0d0-4a64-8994-ba0f0c857e4f","keyName":"e2e-rate-a-0dc4e2","selected_subscription":"e2e-rate-iso-a-0dc4e2","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-0dc4e2@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0dc4e2","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f0553418-6d53-40de-84b0-141ee67891dc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f0553418-6d53-40de-84b0-141ee67891dc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37100","PortSpecifier":{"PortValue":37100}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1570e7a4-7612-4b16-820f-ba938697aca3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37100","PortSpecifier":{"PortValue":37100}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160859,"nanos":271375966},"http":{"id":"1570e7a4-7612-4b16-820f-ba938697aca3","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fbf2a566-4c74-4d18-9b7c-9ff9dfe8d5fe","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0213a02c-9386-4be9-96ee-70d64c422983"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d0b6195560c7"]}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d0b6195560c7"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0213a02c-9386-4be9-96ee-70d64c422983"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fbf2a566-4c74-4d18-9b7c-9ff9dfe8d5fe","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8d075ceae3307c43fb2fe77253b5b8b9809d9d5ec7690cd250f5a245790a992d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1570e7a4-7612-4b16-820f-ba938697aca3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:36908","PortSpecifier":{"PortValue":36908}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e94b3e.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:36908","PortSpecifier":{"PortValue":36908}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160859,"nanos":316695944},"http":{"id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","method":"POST","headers":{":authority":"e2e-shared-b-e94b3e.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fbf2a566-4c74-4d18-9b7c-9ff9dfe8d5fe","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=0213a02c-9386-4be9-96ee-70d64c422983"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d0b6195560c7"]}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d0b6195560c7"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=0213a02c-9386-4be9-96ee-70d64c422983"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fbf2a566-4c74-4d18-9b7c-9ff9dfe8d5fe","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"bb3309a6c372604a693a496f6fd4f34ad4eebc0e8a069e42eebdd4b5f09ea06c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e94b3e.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e94b3e/rate-test-model-e94b3e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-e94b3e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aae5e3a0-bc7f-4994-9b9b-e924b01ebbc6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37112","PortSpecifier":{"PortValue":37112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37112","PortSpecifier":{"PortValue":37112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160859,"nanos":356476031},"http":{"id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a0e919c0-ef09-46fe-898b-75c0b8d73fdb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37124","PortSpecifier":{"PortValue":37124}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37124","PortSpecifier":{"PortValue":37124}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160860,"nanos":391527674},"http":{"id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95f1bd5f-c4f0-456d-8999-dca0ad38c918","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37140","PortSpecifier":{"PortValue":37140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37140","PortSpecifier":{"PortValue":37140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160861,"nanos":422703857},"http":{"id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a038db0f-e2be-4ba2-9320-2a758d6351e6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37142","PortSpecifier":{"PortValue":37142}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"51ad5421-65bf-4c17-b816-64f68f50e810","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37142","PortSpecifier":{"PortValue":37142}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160862,"nanos":455003433},"http":{"id":"51ad5421-65bf-4c17-b816-64f68f50e810","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"51ad5421-65bf-4c17-b816-64f68f50e810","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37156","PortSpecifier":{"PortValue":37156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:37156","PortSpecifier":{"PortValue":37156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160863,"nanos":487247050},"http":{"id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dfff0da4-cb31-48f0-afe3-d923f41909e7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56674","PortSpecifier":{"PortValue":56674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56674","PortSpecifier":{"PortValue":56674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160864,"nanos":518345225},"http":{"id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27a93ee1-d9c8-4442-a065-e6818d4f7a23","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56688","PortSpecifier":{"PortValue":56688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56688","PortSpecifier":{"PortValue":56688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160865,"nanos":551109540},"http":{"id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"010982f6-e91b-4d4c-ba49-be7c94c2dc17","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f4fa9522-3404-48e6-89de-531b960d5191","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56696","PortSpecifier":{"PortValue":56696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f4fa9522-3404-48e6-89de-531b960d5191","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f4fa9522-3404-48e6-89de-531b960d5191","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56696","PortSpecifier":{"PortValue":56696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160866,"nanos":582485369},"http":{"id":"f4fa9522-3404-48e6-89de-531b960d5191","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f4fa9522-3404-48e6-89de-531b960d5191","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f4fa9522-3404-48e6-89de-531b960d5191","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f4fa9522-3404-48e6-89de-531b960d5191","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f4fa9522-3404-48e6-89de-531b960d5191","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56698","PortSpecifier":{"PortValue":56698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56698","PortSpecifier":{"PortValue":56698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160867,"nanos":616864836},"http":{"id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d7f09616-4db5-4d18-9c69-a872e3c37ce5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56714","PortSpecifier":{"PortValue":56714}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56714","PortSpecifier":{"PortValue":56714}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160868,"nanos":649152630},"http":{"id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec5fe9c4-f09d-4cd0-b848-76bb26256fb6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56726","PortSpecifier":{"PortValue":56726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56726","PortSpecifier":{"PortValue":56726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160869,"nanos":682930215},"http":{"id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e44ac139-7a0f-4c8d-b28e-af74df2193bd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56732","PortSpecifier":{"PortValue":56732}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56732","PortSpecifier":{"PortValue":56732}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160870,"nanos":715867059},"http":{"id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b60c163-9c34-40e1-b233-cce6e48b1e08","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56738","PortSpecifier":{"PortValue":56738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","method":"POST","path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions","host":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:56738","PortSpecifier":{"PortValue":56738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160871,"nanos":749135474},"http":{"id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","method":"POST","headers":{":authority":"e2e-shared-a-ef3a1a.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-t1hxw31mXSfPNCrx_CYtcInm8CzHDLc9h6efhgbpnnbWoJgQAVBgCVfGrjh5\"}"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","subscription":"e2e-rate-iso-a-f4f818","tenant":"e2e-shared-a-ef3a1a","userId":"789b43ec-770c-4f5f-a998-c44a562b6f61","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\",\"requestedSubscription\":\"e2e-rate-iso-a-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-ef3a1a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-ef3a1a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"789b43ec-770c-4f5f-a998-c44a562b6f61","keyName":"e2e-rate-a-f4f818","selected_subscription":"e2e-rate-iso-a-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-a-ef3a1a/e2e-rate-iso-a-f4f818@ai-tenant-e2e-shared-a-ef3a1a/rate-test-model-ef3a1a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ef3a1a","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f4f818","namespace":"ai-tenant-e2e-shared-a-ef3a1a","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4908a33-f2d0-463c-bbe2-eda1612638dd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:38972","PortSpecifier":{"PortValue":38972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","method":"POST","path":"/ai-tenant-e2e-shared-b-e94b3e/rate-test-model-e94b3e/v1/completions","host":"e2e-shared-b-e94b3e.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.8:38972","PortSpecifier":{"PortValue":38972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784160871,"nanos":784632255},"http":{"id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","method":"POST","headers":{":authority":"e2e-shared-b-e94b3e.apps.863ba4eb-859d-4108-a543-d0b6195560c7.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-e94b3e/rate-test-model-e94b3e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ju9GyUILKgrFaVQa_W3tnsbwHPoGCQ4dsdINDaKYeSv35kaZjl62lsbTBBQk"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e94b3e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ju9GyUILKgrFaVQa_W3tnsbwHPoGCQ4dsdINDaKYeSv35kaZjl62lsbTBBQk\"}"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e94b3e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"eeff46de-d842-4133-863e-46d1cb8cd978","keyName":"e2e-rate-b-f4f818","subscription":"e2e-rate-iso-b-f4f818","tenant":"e2e-shared-b-e94b3e","userId":"eeff46de-d842-4133-863e-46d1cb8cd978","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-e94b3e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-e94b3e/rate-test-model-e94b3e\",\"requestedSubscription\":\"e2e-rate-iso-b-f4f818\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e94b3e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e94b3e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-f4f818","namespace":"ai-tenant-e2e-shared-b-e94b3e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e94b3e/rate-test-model-e94b3e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-e94b3e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-f4f818"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"eeff46de-d842-4133-863e-46d1cb8cd978","keyName":"e2e-rate-b-f4f818","selected_subscription":"e2e-rate-iso-b-f4f818","selected_subscription_key":"ai-tenant-e2e-shared-b-e94b3e/e2e-rate-iso-b-f4f818@ai-tenant-e2e-shared-b-e94b3e/rate-test-model-e94b3e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e94b3e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-f4f818","namespace":"ai-tenant-e2e-shared-b-e94b3e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T00:14:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13472dd1-ba5d-4459-9b69-a2dbaed8b377","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T00:14:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/16f396e36dacd0b1ca043c6aa051c853b7a3cad548a7cbc2d19bb86038528963"}
{"level":"info","ts":"2026-07-16T00:14:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6491485ca7d891bd90f51c91714e539dc68e52e4847b5057601e0826b4f86de6"}
{"level":"info","ts":"2026-07-16T00:14:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/33c3d9f6dbc626447b1553aa275dff9fc1fcd5795752a868209d251bf927355e"}
{"level":"info","ts":"2026-07-16T00:14:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3dfe1b157cee65e9ce1fa4ea4ce713bcfb32dd636870d50eb834957b2c70453a"}
{"level":"info","ts":"2026-07-16T00:14:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6900d48e98d2d3fadb37fe820422ec38703bdbcb9397917619f6bdd56f5d31ab"}
{"level":"info","ts":"2026-07-16T00:14:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fa050f47a18f526355b9a9e9fdf6aed286c23269ccd8b0f25eda475e1f09f358"}
{"level":"info","ts":"2026-07-16T00:14:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/375eaa92887701f7b0c7289a159c2695ca6609f22d9f6a51673b58f8a054dcc5"}
{"level":"info","ts":"2026-07-16T00:14:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a6c0d709d18a50552548a1070b5f0ff0499adaad43a746dad9f73eb45fa260ff"}
{"level":"info","ts":"2026-07-16T00:14:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85ade64b9866a61601fe60fb7f5f10278d12bdedd282efbe7230a354d1368fb1"}
{"level":"info","ts":"2026-07-16T00:14:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a55ad542d3bbf60e2cfa83468de0cfeab7b945969414d230622126dded5be58d"}
{"level":"info","ts":"2026-07-16T00:14:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8cbaf8927231f1249134200d58d7edf07a3e76d0dc4f6ba4cd87239a1f4039f"}
{"level":"info","ts":"2026-07-16T00:14:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cc6c96cc32e996986980eed6cea046c8d8bf9904b4626e2a7ce85a935974eb4f"}
{"level":"info","ts":"2026-07-16T00:14:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/86fdc50c20e988f53852fdc065ea07a2b50d101fb1da85b0a9c5e97905edac5b"}
{"level":"info","ts":"2026-07-16T00:14:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6d73d11371401d28817bbc12c42c7afe995c6b3ec568457510855a0ef978a8a2"}
{"level":"info","ts":"2026-07-16T00:14:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b8740b1eb84ae2b04dc15144f24f539803490d03c0c5087df4f90ebe1f1dcbca"}
{"level":"info","ts":"2026-07-16T00:14:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8776d18c47df4303ec83ef4f9ea54495532ac3870c7f692246b24c19db54a308"}
{"level":"info","ts":"2026-07-16T00:15:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8d075ceae3307c43fb2fe77253b5b8b9809d9d5ec7690cd250f5a245790a992d"}
{"level":"info","ts":"2026-07-16T00:15:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/963d9c22a23d42f07ff4b8eb8c0a302fc41cad5b7cb47fe96e59bc2d3e77a47f"}
{"level":"info","ts":"2026-07-16T00:15:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bfa97f308cc8d76d68d10f39e53de52c5b26dec702a572dff0d663d96f2ed7d8"}
{"level":"info","ts":"2026-07-16T00:15:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6d54b897ab3f4093b89c2d0c181fb911a42ed60b6ce919ae1b3f5f064ad9d9f0"}
{"level":"info","ts":"2026-07-16T00:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bd7211279100594f6b600dbfc3c1edc490363a6b96bcee4423c79448c21fcd13"}
{"level":"info","ts":"2026-07-16T00:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bb3309a6c372604a693a496f6fd4f34ad4eebc0e8a069e42eebdd4b5f09ea06c"}
{"level":"info","ts":"2026-07-16T00:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a7e3fbfb534dcbc0086df6205088806551d953913c3edf911899e9389183ee47"}
{"level":"info","ts":"2026-07-16T00:15:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7a6889c3af94a821c724640b7afeffc0085c1c782c58511dca133ba44b8a140e"}