{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0b4cae242d063bdc6e92a1859797e40d2e0ed6269091b3f88a8eabd116dd978d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0b4cae242d063bdc6e92a1859797e40d2e0ed6269091b3f88a8eabd116dd978d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0b4cae242d063bdc6e92a1859797e40d2e0ed6269091b3f88a8eabd116dd978d"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0b4cae242d063bdc6e92a1859797e40d2e0ed6269091b3f88a8eabd116dd978d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0b4cae242d063bdc6e92a1859797e40d2e0ed6269091b3f88a8eabd116dd978d"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0b4cae242d063bdc6e92a1859797e40d2e0ed6269091b3f88a8eabd116dd978d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0b4cae242d063bdc6e92a1859797e40d2e0ed6269091b3f88a8eabd116dd978d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0b4cae242d063bdc6e92a1859797e40d2e0ed6269091b3f88a8eabd116dd978d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0b4cae242d063bdc6e92a1859797e40d2e0ed6269091b3f88a8eabd116dd978d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0b4cae242d063bdc6e92a1859797e40d2e0ed6269091b3f88a8eabd116dd978d"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01d9ca2dda58afeee19107a0bf39e1a2fb5942da47b60c4c784e0135d4382179","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01d9ca2dda58afeee19107a0bf39e1a2fb5942da47b60c4c784e0135d4382179"}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ad6a9d14120459b30f9e15fe446be1c16fcae370d7a5f21d7b4197b4bd4c3b02","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ad6a9d14120459b30f9e15fe446be1c16fcae370d7a5f21d7b4197b4bd4c3b02"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d0d186c71d7ddcad7801b344d2f17d51dc54ea6be4102403f206bbe328c091b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d0d186c71d7ddcad7801b344d2f17d51dc54ea6be4102403f206bbe328c091b"}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc5cd44b7c94bc85f70cb68b74e95f904d66bf54348dfdee23a8353bba6f2f75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc5cd44b7c94bc85f70cb68b74e95f904d66bf54348dfdee23a8353bba6f2f75"}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf"}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:57Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf"}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d39678490abe84319e9d7443c3030425ca70ec244ee834c72ae492fcef3e217f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d39678490abe84319e9d7443c3030425ca70ec244ee834c72ae492fcef3e217f"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187"}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187"}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f81154a11d8434fc4c489662a20e2fe51e9bb07a26089cfd51808de660e9fa9e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"773e650e74f2396ab074e3fd096cd0fb2834097d90528061a9377c03efcdb99d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f81154a11d8434fc4c489662a20e2fe51e9bb07a26089cfd51808de660e9fa9e"}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-08T04:02:58Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187"}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/773e650e74f2396ab074e3fd096cd0fb2834097d90528061a9377c03efcdb99d"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ef004a5a213a1de0b19a215e7c388517ba2ade68d26de7114664082c6f54e72","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"15affab103fd4d842743eb162b4964fdd98fb292aee0fa5897e29b0c347f5e93","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8eb7a147d5b9f437ea29af820e588da4e93df23a45b5be12818270430058adc8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ef004a5a213a1de0b19a215e7c388517ba2ade68d26de7114664082c6f54e72"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3ef11762f3d3d3ebacf47db97d1de1294438cd53386fbcb22de9512829bdcd8b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/15affab103fd4d842743eb162b4964fdd98fb292aee0fa5897e29b0c347f5e93"}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8eb7a147d5b9f437ea29af820e588da4e93df23a45b5be12818270430058adc8"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"efaff6ca65c56358efd0bce819c6aa46e45f08129f69374907ee4be92ce00fe6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3ef11762f3d3d3ebacf47db97d1de1294438cd53386fbcb22de9512829bdcd8b"}
{"level":"debug","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5b327efe4d56e563e9666ffc151fe7eb96193ea0102b96a9f11cc3cd8e80561c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/efaff6ca65c56358efd0bce819c6aa46e45f08129f69374907ee4be92ce00fe6"}
{"level":"info","ts":"2026-07-08T04:02:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5b327efe4d56e563e9666ffc151fe7eb96193ea0102b96a9f11cc3cd8e80561c"}
{"level":"info","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38588","PortSpecifier":{"PortValue":38588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38588","PortSpecifier":{"PortValue":38588}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483380,"nanos":228272397},"http":{"id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e3ad0e8a-5c89-438e-9bd1-1b40595085a1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c1d5ad1-cf1a-4b41-a1c4-2e432f4d7338"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1fc21dd6531"]}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1fc21dd6531"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c1d5ad1-cf1a-4b41-a1c4-2e432f4d7338"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e3ad0e8a-5c89-438e-9bd1-1b40595085a1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3d0d186c71d7ddcad7801b344d2f17d51dc54ea6be4102403f206bbe328c091b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.75:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"45cc85e0-de85-45c1-a8cc-e5915c8a11c1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:53046","PortSpecifier":{"PortValue":53046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b98412.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:53046","PortSpecifier":{"PortValue":53046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483380,"nanos":269249678},"http":{"id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","method":"POST","headers":{":authority":"e2e-shared-b-b98412.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e3ad0e8a-5c89-438e-9bd1-1b40595085a1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c1d5ad1-cf1a-4b41-a1c4-2e432f4d7338"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1fc21dd6531"]}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1fc21dd6531"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c1d5ad1-cf1a-4b41-a1c4-2e432f4d7338"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e3ad0e8a-5c89-438e-9bd1-1b40595085a1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"01d9ca2dda58afeee19107a0bf39e1a2fb5942da47b60c4c784e0135d4382179"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.30:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b98412.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b98412/rate-test-model-b98412\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"176b4255-314d-4fb8-9488-84b2cfd8bba1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38592","PortSpecifier":{"PortValue":38592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4b90e3c5-0814-4839-b248-af1a18bddc98","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38592","PortSpecifier":{"PortValue":38592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483380,"nanos":305415943},"http":{"id":"4b90e3c5-0814-4839-b248-af1a18bddc98","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8uReJsGJpvSLLL3T_yWyxA5J41q2etdG4ljMheqFDCn77eGwbnRKRQHaKlcX"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8uReJsGJpvSLLL3T_yWyxA5J41q2etdG4ljMheqFDCn77eGwbnRKRQHaKlcX\"}"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"83b1a7d0-f52f-412e-aa8d-8608b200904a","keyName":"e2e-rate-a-b6baf8","subscription":"e2e-rate-iso-a-b6baf8","tenant":"e2e-shared-a-e356c0","userId":"83b1a7d0-f52f-412e-aa8d-8608b200904a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-b6baf8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6baf8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6baf8"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"83b1a7d0-f52f-412e-aa8d-8608b200904a","keyName":"e2e-rate-a-b6baf8","selected_subscription":"e2e-rate-iso-a-b6baf8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-b6baf8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6baf8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4b90e3c5-0814-4839-b248-af1a18bddc98","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38602","PortSpecifier":{"PortValue":38602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38602","PortSpecifier":{"PortValue":38602}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483381,"nanos":365773565},"http":{"id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8uReJsGJpvSLLL3T_yWyxA5J41q2etdG4ljMheqFDCn77eGwbnRKRQHaKlcX"}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8uReJsGJpvSLLL3T_yWyxA5J41q2etdG4ljMheqFDCn77eGwbnRKRQHaKlcX\"}"}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"83b1a7d0-f52f-412e-aa8d-8608b200904a","keyName":"e2e-rate-a-b6baf8","subscription":"e2e-rate-iso-a-b6baf8","tenant":"e2e-shared-a-e356c0","userId":"83b1a7d0-f52f-412e-aa8d-8608b200904a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-b6baf8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6baf8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6baf8"}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"83b1a7d0-f52f-412e-aa8d-8608b200904a","keyName":"e2e-rate-a-b6baf8","selected_subscription":"e2e-rate-iso-a-b6baf8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-b6baf8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6baf8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"adefcad5-26dc-43b2-b38b-2196ecba12a2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38616","PortSpecifier":{"PortValue":38616}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ed451c9-8959-45c0-9865-9739ecc18699","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38616","PortSpecifier":{"PortValue":38616}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483382,"nanos":435543681},"http":{"id":"8ed451c9-8959-45c0-9865-9739ecc18699","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8uReJsGJpvSLLL3T_yWyxA5J41q2etdG4ljMheqFDCn77eGwbnRKRQHaKlcX"}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8uReJsGJpvSLLL3T_yWyxA5J41q2etdG4ljMheqFDCn77eGwbnRKRQHaKlcX\"}"}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"83b1a7d0-f52f-412e-aa8d-8608b200904a","keyName":"e2e-rate-a-b6baf8","subscription":"e2e-rate-iso-a-b6baf8","tenant":"e2e-shared-a-e356c0","userId":"83b1a7d0-f52f-412e-aa8d-8608b200904a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-b6baf8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6baf8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b6baf8"}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"83b1a7d0-f52f-412e-aa8d-8608b200904a","keyName":"e2e-rate-a-b6baf8","selected_subscription":"e2e-rate-iso-a-b6baf8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-b6baf8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b6baf8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ed451c9-8959-45c0-9865-9739ecc18699","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:33462","PortSpecifier":{"PortValue":33462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7072f47e-3806-4950-95aa-400f0712f2ac","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:33462","PortSpecifier":{"PortValue":33462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483391,"nanos":13864297},"http":{"id":"7072f47e-3806-4950-95aa-400f0712f2ac","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e3ad0e8a-5c89-438e-9bd1-1b40595085a1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c1d5ad1-cf1a-4b41-a1c4-2e432f4d7338"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1fc21dd6531"]}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1fc21dd6531"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c1d5ad1-cf1a-4b41-a1c4-2e432f4d7338"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e3ad0e8a-5c89-438e-9bd1-1b40595085a1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3d0d186c71d7ddcad7801b344d2f17d51dc54ea6be4102403f206bbe328c091b"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.75:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7072f47e-3806-4950-95aa-400f0712f2ac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:57104","PortSpecifier":{"PortValue":57104}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b98412.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:57104","PortSpecifier":{"PortValue":57104}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483391,"nanos":50448843},"http":{"id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","method":"POST","headers":{":authority":"e2e-shared-b-b98412.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e3ad0e8a-5c89-438e-9bd1-1b40595085a1","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c1d5ad1-cf1a-4b41-a1c4-2e432f4d7338"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1fc21dd6531"]}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b1fc21dd6531"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=1c1d5ad1-cf1a-4b41-a1c4-2e432f4d7338"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e3ad0e8a-5c89-438e-9bd1-1b40595085a1","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"01d9ca2dda58afeee19107a0bf39e1a2fb5942da47b60c4c784e0135d4382179"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.30:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b98412.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b98412/rate-test-model-b98412\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db54eb54-b6d6-4757-80bb-cec8ff5ad257","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:33476","PortSpecifier":{"PortValue":33476}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:33476","PortSpecifier":{"PortValue":33476}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483391,"nanos":83917127},"http":{"id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk\"}"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","subscription":"e2e-rate-iso-a-e829e8","tenant":"e2e-shared-a-e356c0","userId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-e829e8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e829e8"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","selected_subscription":"e2e-rate-iso-a-e829e8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-e829e8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa64f2f4-23b5-40b6-9519-c88b57e4d809","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:33480","PortSpecifier":{"PortValue":33480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6150dc19-8596-478d-b0b2-95fe810b4103","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:33480","PortSpecifier":{"PortValue":33480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483392,"nanos":119993582},"http":{"id":"6150dc19-8596-478d-b0b2-95fe810b4103","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk"}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk\"}"}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","subscription":"e2e-rate-iso-a-e829e8","tenant":"e2e-shared-a-e356c0","userId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-e829e8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e829e8"}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","selected_subscription":"e2e-rate-iso-a-e829e8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-e829e8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6150dc19-8596-478d-b0b2-95fe810b4103","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"409f9523-c33f-4489-ab85-718bfdb60511","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:33496","PortSpecifier":{"PortValue":33496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"409f9523-c33f-4489-ab85-718bfdb60511","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"409f9523-c33f-4489-ab85-718bfdb60511","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:33496","PortSpecifier":{"PortValue":33496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483393,"nanos":157723858},"http":{"id":"409f9523-c33f-4489-ab85-718bfdb60511","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk"}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk\"}"}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","subscription":"e2e-rate-iso-a-e829e8","tenant":"e2e-shared-a-e356c0","userId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-e829e8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"409f9523-c33f-4489-ab85-718bfdb60511","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e829e8"}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"409f9523-c33f-4489-ab85-718bfdb60511","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","selected_subscription":"e2e-rate-iso-a-e829e8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-e829e8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"409f9523-c33f-4489-ab85-718bfdb60511","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"409f9523-c33f-4489-ab85-718bfdb60511","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:33500","PortSpecifier":{"PortValue":33500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:33500","PortSpecifier":{"PortValue":33500}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483394,"nanos":189504780},"http":{"id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk"}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk\"}"}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","subscription":"e2e-rate-iso-a-e829e8","tenant":"e2e-shared-a-e356c0","userId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-e829e8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e829e8"}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","selected_subscription":"e2e-rate-iso-a-e829e8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-e829e8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ef79ad9-78e1-4ecc-8ad5-2b9632e202bf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"978bf764-5742-4ab2-b56e-83aff8425017","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59778","PortSpecifier":{"PortValue":59778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"978bf764-5742-4ab2-b56e-83aff8425017","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"978bf764-5742-4ab2-b56e-83aff8425017","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59778","PortSpecifier":{"PortValue":59778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483395,"nanos":222396202},"http":{"id":"978bf764-5742-4ab2-b56e-83aff8425017","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk"}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk\"}"}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","subscription":"e2e-rate-iso-a-e829e8","tenant":"e2e-shared-a-e356c0","userId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-e829e8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"978bf764-5742-4ab2-b56e-83aff8425017","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e829e8"}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"978bf764-5742-4ab2-b56e-83aff8425017","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","selected_subscription":"e2e-rate-iso-a-e829e8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-e829e8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"978bf764-5742-4ab2-b56e-83aff8425017","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"978bf764-5742-4ab2-b56e-83aff8425017","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59794","PortSpecifier":{"PortValue":59794}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"817fefc4-0e37-474f-8467-2f9863a29a21","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59794","PortSpecifier":{"PortValue":59794}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483396,"nanos":255293605},"http":{"id":"817fefc4-0e37-474f-8467-2f9863a29a21","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk"}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk\"}"}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","subscription":"e2e-rate-iso-a-e829e8","tenant":"e2e-shared-a-e356c0","userId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-e829e8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e829e8"}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","selected_subscription":"e2e-rate-iso-a-e829e8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-e829e8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"817fefc4-0e37-474f-8467-2f9863a29a21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59810","PortSpecifier":{"PortValue":59810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3e57821c-ac17-49a0-919d-554e105b05f6","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59810","PortSpecifier":{"PortValue":59810}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483397,"nanos":289844084},"http":{"id":"3e57821c-ac17-49a0-919d-554e105b05f6","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk"}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk\"}"}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","subscription":"e2e-rate-iso-a-e829e8","tenant":"e2e-shared-a-e356c0","userId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-e829e8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e829e8"}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","selected_subscription":"e2e-rate-iso-a-e829e8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-e829e8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3e57821c-ac17-49a0-919d-554e105b05f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59822","PortSpecifier":{"PortValue":59822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59822","PortSpecifier":{"PortValue":59822}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483398,"nanos":324592689},"http":{"id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk"}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk\"}"}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","subscription":"e2e-rate-iso-a-e829e8","tenant":"e2e-shared-a-e356c0","userId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-e829e8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e829e8"}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","selected_subscription":"e2e-rate-iso-a-e829e8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-e829e8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37370a10-e7dc-4171-99ba-858eab6ad8dc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59834","PortSpecifier":{"PortValue":59834}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b67e384-6b26-4e89-a913-32a79757d2d7","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59834","PortSpecifier":{"PortValue":59834}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483399,"nanos":358071953},"http":{"id":"3b67e384-6b26-4e89-a913-32a79757d2d7","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk"}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk\"}"}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","subscription":"e2e-rate-iso-a-e829e8","tenant":"e2e-shared-a-e356c0","userId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-e829e8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e829e8"}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","selected_subscription":"e2e-rate-iso-a-e829e8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-e829e8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b67e384-6b26-4e89-a913-32a79757d2d7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59838","PortSpecifier":{"PortValue":59838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"97a75019-90db-4912-8bfc-b6cb44eae14c","method":"POST","path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions","host":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59838","PortSpecifier":{"PortValue":59838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483400,"nanos":394642678},"http":{"id":"97a75019-90db-4912-8bfc-b6cb44eae14c","method":"POST","headers":{":authority":"e2e-shared-a-e356c0.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-gNIjWJ2Zf5CGeQ6b_32mhjHQ2fdicLCMZQrYDwtZVHm22hf59yzcHBxj9ZYk\"}"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","subscription":"e2e-rate-iso-a-e829e8","tenant":"e2e-shared-a-e356c0","userId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\",\"requestedSubscription\":\"e2e-rate-iso-a-e829e8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e356c0.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e829e8"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"265d826b-25d8-4d2a-9a81-ea47b5be7a51","keyName":"e2e-rate-a-e829e8","selected_subscription":"e2e-rate-iso-a-e829e8","selected_subscription_key":"ai-tenant-e2e-shared-a-e356c0/e2e-rate-iso-a-e829e8@ai-tenant-e2e-shared-a-e356c0/rate-test-model-e356c0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e356c0","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e829e8","namespace":"ai-tenant-e2e-shared-a-e356c0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"97a75019-90db-4912-8bfc-b6cb44eae14c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:40200","PortSpecifier":{"PortValue":40200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","method":"POST","path":"/ai-tenant-e2e-shared-b-b98412/rate-test-model-b98412/v1/completions","host":"e2e-shared-b-b98412.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:40200","PortSpecifier":{"PortValue":40200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.30:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783483400,"nanos":456336409},"http":{"id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","method":"POST","headers":{":authority":"e2e-shared-b-b98412.apps.c36f7209-bebf-4ca3-9350-b1fc21dd6531.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-b98412/rate-test-model-b98412/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8IsE4OpIMqEZJsG1_sKr1td4IfRGr1wlpcM0z0uYRj8nAXX2zAmEDU0WtIJF"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-b98412.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-8IsE4OpIMqEZJsG1_sKr1td4IfRGr1wlpcM0z0uYRj8nAXX2zAmEDU0WtIJF\"}"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b98412.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b0d87d39-c419-4ba7-8c10-da54800f1c8a","keyName":"e2e-rate-b-e829e8","subscription":"e2e-rate-iso-b-e829e8","tenant":"e2e-shared-b-b98412","userId":"b0d87d39-c419-4ba7-8c10-da54800f1c8a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-b98412.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-b98412/rate-test-model-b98412\",\"requestedSubscription\":\"e2e-rate-iso-b-e829e8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b98412.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b98412","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e829e8","namespace":"ai-tenant-e2e-shared-b-b98412","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b98412/rate-test-model-b98412\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-e829e8"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b0d87d39-c419-4ba7-8c10-da54800f1c8a","keyName":"e2e-rate-b-e829e8","selected_subscription":"e2e-rate-iso-b-e829e8","selected_subscription_key":"ai-tenant-e2e-shared-b-b98412/e2e-rate-iso-b-e829e8@ai-tenant-e2e-shared-b-b98412/rate-test-model-b98412","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b98412","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e829e8","namespace":"ai-tenant-e2e-shared-b-b98412","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-08T04:03:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a1fa777-020c-4ebc-9f26-d096ea5d9624","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-08T04:03:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ad6a9d14120459b30f9e15fe446be1c16fcae370d7a5f21d7b4197b4bd4c3b02"}
{"level":"info","ts":"2026-07-08T04:03:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3ef11762f3d3d3ebacf47db97d1de1294438cd53386fbcb22de9512829bdcd8b"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d39678490abe84319e9d7443c3030425ca70ec244ee834c72ae492fcef3e217f"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f81154a11d8434fc4c489662a20e2fe51e9bb07a26089cfd51808de660e9fa9e"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ef35bf3c71c8349f6265de7dc65e187e425cf4cfc6633a16a08064cfafe72e3c"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0a3d77386d9b7093631680d75d823f8f6489820ce1706da4ebaa67a3d0d2102e"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ef004a5a213a1de0b19a215e7c388517ba2ade68d26de7114664082c6f54e72"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bc5cd44b7c94bc85f70cb68b74e95f904d66bf54348dfdee23a8353bba6f2f75"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0b4cae242d063bdc6e92a1859797e40d2e0ed6269091b3f88a8eabd116dd978d"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/15affab103fd4d842743eb162b4964fdd98fb292aee0fa5897e29b0c347f5e93"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dc7b80c3858059efc1053df1492a29c2872e44c73a5a059b2ebf51984f69a385"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9d94ada482999a7c358d2537e2255ce17ec7b8bf88ac5b20254658f46508a8bf"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5b327efe4d56e563e9666ffc151fe7eb96193ea0102b96a9f11cc3cd8e80561c"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8eb7a147d5b9f437ea29af820e588da4e93df23a45b5be12818270430058adc8"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/efaff6ca65c56358efd0bce819c6aa46e45f08129f69374907ee4be92ce00fe6"}
{"level":"info","ts":"2026-07-08T04:03:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6b3dffbbbea5402851e946877a06f1a603dbf14f4f995d8e48e4b6e5910acc3d"}
{"level":"info","ts":"2026-07-08T04:03:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3d0d186c71d7ddcad7801b344d2f17d51dc54ea6be4102403f206bbe328c091b"}
{"level":"info","ts":"2026-07-08T04:03:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6680e3635681a336ae91c7a1047a63efcfd15ba7ff38924a33d316b2ce26b187"}
{"level":"info","ts":"2026-07-08T04:04:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/01d9ca2dda58afeee19107a0bf39e1a2fb5942da47b60c4c784e0135d4382179"}
{"level":"info","ts":"2026-07-08T04:04:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/773e650e74f2396ab074e3fd096cd0fb2834097d90528061a9377c03efcdb99d"}