--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"info","ts":"2026-07-02T17:36:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/62d338d035691d988ec19df85517a7a4a0b47269b06688376d46d666100bb286"}
{"level":"info","ts":"2026-07-02T17:36:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b007ba2cd2c1034f9301076d4d44e3245431ed08320bd9f505e811a4b884753c"}
{"level":"info","ts":"2026-07-02T17:36:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/579007990f66cdbccc1d193d96e2e4ea303b2be7818198303ea8b44f8c87a678"}
{"level":"info","ts":"2026-07-02T17:36:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ed5e6a093cccd7123be63b2570eca9dff338c4a4d7e28d95b4ebdb23b6d6f9c9"}
{"level":"info","ts":"2026-07-02T17:36:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3218faf8635d6052e2da3726e960d47461a8f02585d2b514c9a2c711a418d984"}
{"level":"info","ts":"2026-07-02T17:36:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1165e109e32ef6d54c51d8725c2029a96e80c5ff4aa56fd6ecd1b8037e17a3ce"}
{"level":"info","ts":"2026-07-02T17:36:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/80b6616a8823957ce68eed4caef02bafa70ed4760ab3c1f76efbe3aa51369473"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3"}
{"level":"debug","ts":"2026-07-02T17:36:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea"}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:36:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:36:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c"}
{"level":"debug","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:15Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655"}
{"level":"info","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655"}
{"level":"debug","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655"}
{"level":"debug","ts":"2026-07-02T17:37:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109"}
{"level":"error","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169"}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c"}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:37:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b87ae20be634e7941a82681131b84d2144485c86ddbf9a8d229325d7b1c9c657","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dda0fffe0e9844459121fff00307415c1bacf5fadfde9732208445b2ade76dd2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc"}
{"level":"debug","ts":"2026-07-02T17:37:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b87ae20be634e7941a82681131b84d2144485c86ddbf9a8d229325d7b1c9c657","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b87ae20be634e7941a82681131b84d2144485c86ddbf9a8d229325d7b1c9c657"}
{"level":"debug","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dda0fffe0e9844459121fff00307415c1bacf5fadfde9732208445b2ade76dd2","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:37:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dda0fffe0e9844459121fff00307415c1bacf5fadfde9732208445b2ade76dd2"}
{"level":"info","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:50472","PortSpecifier":{"PortValue":50472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:50472","PortSpecifier":{"PortValue":50472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013855,"nanos":245303207},"http":{"id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"]}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/sub-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d5f2bd0-b7db-485b-b59b-fb63136ec5eb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52630","PortSpecifier":{"PortValue":52630}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52630","PortSpecifier":{"PortValue":52630}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013855,"nanos":287400272},"http":{"id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","method":"POST","headers":{":authority":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"]}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d87672/sub-test-model-d87672\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"690eeb02-1cb1-4ccb-b279-bc7454264fb5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:50482","PortSpecifier":{"PortValue":50482}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:50482","PortSpecifier":{"PortValue":50482}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013855,"nanos":333517213},"http":{"id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","method":"GET","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FY9yteWTSIpZi8tC_Nt4Kq7W7EE0QyC12uAp6lGWTQaXBAKtPPAIOEF0Nc8p"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FY9yteWTSIpZi8tC_Nt4Kq7W7EE0QyC12uAp6lGWTQaXBAKtPPAIOEF0Nc8p\"}"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9dd64caf-c309-464c-83a6-912a54763587","keyName":"e2e-sub-iso-7d8023","subscription":"e2e-a-only-800423","tenant":"e2e-shared-a-0e06fb","userId":"9dd64caf-c309-464c-83a6-912a54763587","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/sub-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-800423"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20449395-4cd8-4ffa-a600-7cffeb6e0003","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b2388908-fffa-4847-ba43-514fa78963bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52638","PortSpecifier":{"PortValue":52638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b2388908-fffa-4847-ba43-514fa78963bb","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b2388908-fffa-4847-ba43-514fa78963bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:52638","PortSpecifier":{"PortValue":52638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013855,"nanos":364214802},"http":{"id":"b2388908-fffa-4847-ba43-514fa78963bb","method":"GET","headers":{":authority":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b2388908-fffa-4847-ba43-514fa78963bb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1CG7Mo9i1GVtfOKXd_KHaxLb28QPejTXCRv8bPARLsX6tesyLfYdsUmOOGfJJ"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b2388908-fffa-4847-ba43-514fa78963bb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d87672.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1CG7Mo9i1GVtfOKXd_KHaxLb28QPejTXCRv8bPARLsX6tesyLfYdsUmOOGfJJ\"}"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b2388908-fffa-4847-ba43-514fa78963bb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d87672.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0d6c17a2-dfef-4af9-be54-01b11ca4e40a","keyName":"e2e-sub-iso-281090","subscription":"e2e-b-only-800423","tenant":"e2e-shared-b-d87672","userId":"0d6c17a2-dfef-4af9-be54-01b11ca4e40a","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b2388908-fffa-4847-ba43-514fa78963bb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b2388908-fffa-4847-ba43-514fa78963bb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b2388908-fffa-4847-ba43-514fa78963bb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b2388908-fffa-4847-ba43-514fa78963bb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d87672/sub-test-model-d87672\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b2388908-fffa-4847-ba43-514fa78963bb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b2388908-fffa-4847-ba43-514fa78963bb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b2388908-fffa-4847-ba43-514fa78963bb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b2388908-fffa-4847-ba43-514fa78963bb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-800423"}
{"level":"info","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b2388908-fffa-4847-ba43-514fa78963bb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b2388908-fffa-4847-ba43-514fa78963bb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:36508","PortSpecifier":{"PortValue":36508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d3669e43-6233-4854-8b7e-c2efc7185811","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:36508","PortSpecifier":{"PortValue":36508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013867,"nanos":560557004},"http":{"id":"d3669e43-6233-4854-8b7e-c2efc7185811","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"]}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/sub-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3669e43-6233-4854-8b7e-c2efc7185811","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55436","PortSpecifier":{"PortValue":55436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55436","PortSpecifier":{"PortValue":55436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013867,"nanos":602935093},"http":{"id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","method":"POST","headers":{":authority":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"]}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d87672/sub-test-model-d87672\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d99fce6d-73a3-4294-b4ef-178e88ebf4fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:36518","PortSpecifier":{"PortValue":36518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"16d5e9e6-5e00-4076-8c62-119400a257bc","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:36518","PortSpecifier":{"PortValue":36518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013867,"nanos":644101369},"http":{"id":"16d5e9e6-5e00-4076-8c62-119400a257bc","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1W2hFCPaNy0zaJfYg_aeauHmFs5RHGWpyQIAUOMBKIEsdafIjpImi6nmyJmzi"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1W2hFCPaNy0zaJfYg_aeauHmFs5RHGWpyQIAUOMBKIEsdafIjpImi6nmyJmzi\"}"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"30773a38-faee-4bfb-91df-c0758954e9d9","keyName":"e2e-sub-iso-6d06bc","subscription":"e2e-shared-sub-68dd11","tenant":"e2e-shared-a-0e06fb","userId":"30773a38-faee-4bfb-91df-c0758954e9d9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/sub-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-68dd11"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"16d5e9e6-5e00-4076-8c62-119400a257bc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55442","PortSpecifier":{"PortValue":55442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55442","PortSpecifier":{"PortValue":55442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013867,"nanos":675104599},"http":{"id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","method":"POST","headers":{":authority":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-GXBf9K3a1YxDouwP_fXm93avUctl7gC5X1URTUu8cQ5GSs9SuVmPPRvm2JpQ"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d87672.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-GXBf9K3a1YxDouwP_fXm93avUctl7gC5X1URTUu8cQ5GSs9SuVmPPRvm2JpQ\"}"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d87672.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2a6ea1a1-1a74-44c6-85d4-69bab4084619","keyName":"e2e-sub-iso-539b55","subscription":"e2e-shared-sub-68dd11","tenant":"e2e-shared-b-d87672","userId":"2a6ea1a1-1a74-44c6-85d4-69bab4084619","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d87672/sub-test-model-d87672\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-68dd11"}
{"level":"info","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"188836fc-f3ec-47b0-bd32-6ee8f7558452","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:37:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1b23ac523ccb61e4e4c26923bcda52686d56f3e18e352fc8586c3355edf75d1c"}
{"level":"info","ts":"2026-07-02T17:37:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6a01132a1a28fd652baed809f7661cc53af1a4931c131d58aa7b0e04a0a23dea"}
{"level":"info","ts":"2026-07-02T17:37:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5045779d0a49118382ff2d790345845bbb5d02c9fbd7eee3c111064cb8eafa77"}
{"level":"info","ts":"2026-07-02T17:37:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d15fa4fe0fb5f2ddd97daa1ec40892771e9c99ad65cdf6537a1701b44fe0f225"}
{"level":"info","ts":"2026-07-02T17:37:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e07dd3b5265c14b255c4a25839d45269b95bfbd484197792a74084f287af45b9"}
{"level":"info","ts":"2026-07-02T17:37:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8090195ec8de82ce7ee01e805e3d9bf6199f00fbfaba09a77ff99a98edbd3c3"}
{"level":"info","ts":"2026-07-02T17:37:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a3301741040f138c298abe1a3c4cbe3aed0802f211cf0cc63c50c8c26c29929c"}
{"level":"info","ts":"2026-07-02T17:37:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9c6f3cbafb9fb75a9e3c82b102787a90d8821d385c266ee7692c18aadebe78bc"}
{"level":"debug","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:00Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966"}
{"level":"debug","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:00Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:00Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966"}
{"level":"debug","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:00Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee"}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325"}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68"}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d2e0c8b94e6d1f9957ef7e13e3d7e6bda10ed86e824c8bbdf74a0f73c08d7109"}
{"level":"debug","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/de1b580a43c5c4de3ab6a953dc56b77e620b2f54c5ce2047f543dc745306944b"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e8628f231286d4b7e8076f51d0a3fc8a020c7e8b6c09d0960742ee5a3622d247"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/54417532982f5c10a0308ed284230cdfe1014dd98e5229a37549172f98a8f6e7"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d6a735925c092aaf42281b1a2ac4d233258a6d61fe54cc9d359193898659f316"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d802523b0a5c590f30f20c43f60cb182d42e1fa1d80c7192f2c41e4b1987f169"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1aac365c7afd35e7e67d90a5ab55fbcaaf0f77411e3c30aff7e721e779d2b7c9"}
{"level":"info","ts":"2026-07-02T17:38:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b2594c6b30fe766f48f9ed253fb94b352c0ba06f6f8769b255cc2de8aa05c655"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338"}
{"level":"error","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"}
{"level":"debug","ts":"2026-07-02T17:38:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dda0fffe0e9844459121fff00307415c1bacf5fadfde9732208445b2ade76dd2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dda0fffe0e9844459121fff00307415c1bacf5fadfde9732208445b2ade76dd2","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dda0fffe0e9844459121fff00307415c1bacf5fadfde9732208445b2ade76dd2"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T17:38:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b87ae20be634e7941a82681131b84d2144485c86ddbf9a8d229325d7b1c9c657","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338"}
{"level":"debug","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b87ae20be634e7941a82681131b84d2144485c86ddbf9a8d229325d7b1c9c657","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:38:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b87ae20be634e7941a82681131b84d2144485c86ddbf9a8d229325d7b1c9c657"}
{"level":"info","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:37814","PortSpecifier":{"PortValue":37814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:37814","PortSpecifier":{"PortValue":37814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013921,"nanos":171288863},"http":{"id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"]}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fbeb1922-3e7d-46fd-823b-5365d7d90eb7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:48946","PortSpecifier":{"PortValue":48946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b51334b8-63c6-420b-9d02-a53e4e2392de","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:48946","PortSpecifier":{"PortValue":48946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013921,"nanos":216730294},"http":{"id":"b51334b8-63c6-420b-9d02-a53e4e2392de","method":"POST","headers":{":authority":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"]}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d87672/rate-test-model-d87672\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b51334b8-63c6-420b-9d02-a53e4e2392de","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"06256b78-23ab-4322-899c-71d420424753","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:37820","PortSpecifier":{"PortValue":37820}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"06256b78-23ab-4322-899c-71d420424753","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"06256b78-23ab-4322-899c-71d420424753","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:37820","PortSpecifier":{"PortValue":37820}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013921,"nanos":258133250},"http":{"id":"06256b78-23ab-4322-899c-71d420424753","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"06256b78-23ab-4322-899c-71d420424753","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KAIBlmSWVYkwMDqU_JaEfjdwWqdTs0u13Ot5XQfww0mr9sIHAFhyrqDnPEbA"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"06256b78-23ab-4322-899c-71d420424753","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KAIBlmSWVYkwMDqU_JaEfjdwWqdTs0u13Ot5XQfww0mr9sIHAFhyrqDnPEbA\"}"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"06256b78-23ab-4322-899c-71d420424753","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"90fb72a8-74fd-4212-98a0-988de24279e5","keyName":"e2e-rate-a-b38e4b","subscription":"e2e-rate-iso-a-b38e4b","tenant":"e2e-shared-a-0e06fb","userId":"90fb72a8-74fd-4212-98a0-988de24279e5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"06256b78-23ab-4322-899c-71d420424753","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-b38e4b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"06256b78-23ab-4322-899c-71d420424753","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b38e4b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"06256b78-23ab-4322-899c-71d420424753","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06256b78-23ab-4322-899c-71d420424753","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06256b78-23ab-4322-899c-71d420424753","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06256b78-23ab-4322-899c-71d420424753","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06256b78-23ab-4322-899c-71d420424753","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06256b78-23ab-4322-899c-71d420424753","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06256b78-23ab-4322-899c-71d420424753","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06256b78-23ab-4322-899c-71d420424753","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b38e4b"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06256b78-23ab-4322-899c-71d420424753","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"90fb72a8-74fd-4212-98a0-988de24279e5","keyName":"e2e-rate-a-b38e4b","selected_subscription":"e2e-rate-iso-a-b38e4b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-b38e4b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b38e4b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"06256b78-23ab-4322-899c-71d420424753","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"06256b78-23ab-4322-899c-71d420424753","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:37828","PortSpecifier":{"PortValue":37828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:37828","PortSpecifier":{"PortValue":37828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013922,"nanos":312250796},"http":{"id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KAIBlmSWVYkwMDqU_JaEfjdwWqdTs0u13Ot5XQfww0mr9sIHAFhyrqDnPEbA"}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KAIBlmSWVYkwMDqU_JaEfjdwWqdTs0u13Ot5XQfww0mr9sIHAFhyrqDnPEbA\"}"}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"90fb72a8-74fd-4212-98a0-988de24279e5","keyName":"e2e-rate-a-b38e4b","subscription":"e2e-rate-iso-a-b38e4b","tenant":"e2e-shared-a-0e06fb","userId":"90fb72a8-74fd-4212-98a0-988de24279e5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-b38e4b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b38e4b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b38e4b"}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"90fb72a8-74fd-4212-98a0-988de24279e5","keyName":"e2e-rate-a-b38e4b","selected_subscription":"e2e-rate-iso-a-b38e4b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-b38e4b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b38e4b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ac447b9-cdec-441c-b5d8-ae32e7c99539","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:37838","PortSpecifier":{"PortValue":37838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:37838","PortSpecifier":{"PortValue":37838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013923,"nanos":358756658},"http":{"id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KAIBlmSWVYkwMDqU_JaEfjdwWqdTs0u13Ot5XQfww0mr9sIHAFhyrqDnPEbA"}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KAIBlmSWVYkwMDqU_JaEfjdwWqdTs0u13Ot5XQfww0mr9sIHAFhyrqDnPEbA\"}"}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"90fb72a8-74fd-4212-98a0-988de24279e5","keyName":"e2e-rate-a-b38e4b","subscription":"e2e-rate-iso-a-b38e4b","tenant":"e2e-shared-a-0e06fb","userId":"90fb72a8-74fd-4212-98a0-988de24279e5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-b38e4b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b38e4b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b38e4b"}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"90fb72a8-74fd-4212-98a0-988de24279e5","keyName":"e2e-rate-a-b38e4b","selected_subscription":"e2e-rate-iso-a-b38e4b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-b38e4b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b38e4b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b7223e5-b73b-4232-ad8f-6ae2c6463732","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55662","PortSpecifier":{"PortValue":55662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55662","PortSpecifier":{"PortValue":55662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013932,"nanos":55125150},"http":{"id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"]}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c37e622e-0ed3-4ff6-9c51-1a6bfd155f5f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:42502","PortSpecifier":{"PortValue":42502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:42502","PortSpecifier":{"PortValue":42502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013932,"nanos":97680444},"http":{"id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","method":"POST","headers":{":authority":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"]}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b016758bdda0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=581fe4e6-67c4-4205-892d-7f801233e404"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5503ca1f-d994-4a6d-ae52-bb69f3e90684","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d87672/rate-test-model-d87672\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ceae987c-ee39-4876-8ce0-07f8bcda7359","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55674","PortSpecifier":{"PortValue":55674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55674","PortSpecifier":{"PortValue":55674}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013932,"nanos":136336841},"http":{"id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy\"}"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","subscription":"e2e-rate-iso-a-64664b","tenant":"e2e-shared-a-0e06fb","userId":"14ed7578-11a3-46f7-895d-6427e23fabe0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-64664b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64664b"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","selected_subscription":"e2e-rate-iso-a-64664b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-64664b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3895ce54-c482-4a78-bc2a-d4b7fa6a111a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55690","PortSpecifier":{"PortValue":55690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55690","PortSpecifier":{"PortValue":55690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013933,"nanos":172604552},"http":{"id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy"}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy\"}"}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","subscription":"e2e-rate-iso-a-64664b","tenant":"e2e-shared-a-0e06fb","userId":"14ed7578-11a3-46f7-895d-6427e23fabe0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-64664b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64664b"}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","selected_subscription":"e2e-rate-iso-a-64664b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-64664b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb7049ef-c3e5-4085-8103-ff6c8dd9f0d8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55704","PortSpecifier":{"PortValue":55704}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55704","PortSpecifier":{"PortValue":55704}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013934,"nanos":213050300},"http":{"id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy"}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy\"}"}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","subscription":"e2e-rate-iso-a-64664b","tenant":"e2e-shared-a-0e06fb","userId":"14ed7578-11a3-46f7-895d-6427e23fabe0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-64664b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64664b"}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","selected_subscription":"e2e-rate-iso-a-64664b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-64664b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ff3fb75b-1d13-4e68-95e8-269a79105fd6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55706","PortSpecifier":{"PortValue":55706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55706","PortSpecifier":{"PortValue":55706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013935,"nanos":253590567},"http":{"id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy"}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy\"}"}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","subscription":"e2e-rate-iso-a-64664b","tenant":"e2e-shared-a-0e06fb","userId":"14ed7578-11a3-46f7-895d-6427e23fabe0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-64664b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64664b"}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","selected_subscription":"e2e-rate-iso-a-64664b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-64664b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"25a5fa79-9d09-43fe-8e14-bb3e5212ff02","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55710","PortSpecifier":{"PortValue":55710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"420dea31-d87a-4a56-89ac-6b925054a5f3","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55710","PortSpecifier":{"PortValue":55710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013936,"nanos":293901634},"http":{"id":"420dea31-d87a-4a56-89ac-6b925054a5f3","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy"}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy\"}"}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","subscription":"e2e-rate-iso-a-64664b","tenant":"e2e-shared-a-0e06fb","userId":"14ed7578-11a3-46f7-895d-6427e23fabe0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-64664b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64664b"}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","selected_subscription":"e2e-rate-iso-a-64664b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-64664b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"420dea31-d87a-4a56-89ac-6b925054a5f3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55712","PortSpecifier":{"PortValue":55712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55712","PortSpecifier":{"PortValue":55712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013937,"nanos":330244785},"http":{"id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy"}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy\"}"}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","subscription":"e2e-rate-iso-a-64664b","tenant":"e2e-shared-a-0e06fb","userId":"14ed7578-11a3-46f7-895d-6427e23fabe0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-64664b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64664b"}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","selected_subscription":"e2e-rate-iso-a-64664b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-64664b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b9e4ffa-5219-47e7-89d7-493a5aadb6cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55720","PortSpecifier":{"PortValue":55720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0391ac4a-21d4-46fc-9f67-4066f851899d","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55720","PortSpecifier":{"PortValue":55720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013938,"nanos":369472368},"http":{"id":"0391ac4a-21d4-46fc-9f67-4066f851899d","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy"}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy\"}"}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","subscription":"e2e-rate-iso-a-64664b","tenant":"e2e-shared-a-0e06fb","userId":"14ed7578-11a3-46f7-895d-6427e23fabe0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-64664b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64664b"}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","selected_subscription":"e2e-rate-iso-a-64664b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-64664b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0391ac4a-21d4-46fc-9f67-4066f851899d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55734","PortSpecifier":{"PortValue":55734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55734","PortSpecifier":{"PortValue":55734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013939,"nanos":405943728},"http":{"id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy"}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy\"}"}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","subscription":"e2e-rate-iso-a-64664b","tenant":"e2e-shared-a-0e06fb","userId":"14ed7578-11a3-46f7-895d-6427e23fabe0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-64664b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64664b"}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","selected_subscription":"e2e-rate-iso-a-64664b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-64664b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:38:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1ec4e610-35a4-4387-9e38-73dc15f9cdf2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a0cf249-839c-403b-89b1-9985017152d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55744","PortSpecifier":{"PortValue":55744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a0cf249-839c-403b-89b1-9985017152d9","method":"POST","path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions","host":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a0cf249-839c-403b-89b1-9985017152d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:55744","PortSpecifier":{"PortValue":55744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013940,"nanos":445947781},"http":{"id":"1a0cf249-839c-403b-89b1-9985017152d9","method":"POST","headers":{":authority":"e2e-shared-a-0e06fb.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Mh8vbni9z9VzUWys_ZaojQWkgsihgxWPrKAcsBFPwQr7JIaGt6W5vUpM7vxy\"}"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","subscription":"e2e-rate-iso-a-64664b","tenant":"e2e-shared-a-0e06fb","userId":"14ed7578-11a3-46f7-895d-6427e23fabe0","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\",\"requestedSubscription\":\"e2e-rate-iso-a-64664b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-0e06fb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a0cf249-839c-403b-89b1-9985017152d9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-64664b"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a0cf249-839c-403b-89b1-9985017152d9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"14ed7578-11a3-46f7-895d-6427e23fabe0","keyName":"e2e-rate-a-64664b","selected_subscription":"e2e-rate-iso-a-64664b","selected_subscription_key":"ai-tenant-e2e-shared-a-0e06fb/e2e-rate-iso-a-64664b@ai-tenant-e2e-shared-a-0e06fb/rate-test-model-0e06fb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-0e06fb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-64664b","namespace":"ai-tenant-e2e-shared-a-0e06fb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a0cf249-839c-403b-89b1-9985017152d9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a0cf249-839c-403b-89b1-9985017152d9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:42516","PortSpecifier":{"PortValue":42516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","method":"POST","path":"/ai-tenant-e2e-shared-b-d87672/rate-test-model-d87672/v1/completions","host":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:42516","PortSpecifier":{"PortValue":42516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013940,"nanos":481869671},"http":{"id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","method":"POST","headers":{":authority":"e2e-shared-b-d87672.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-d87672/rate-test-model-d87672/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-18rV5NWB60xjXDy3F_JtRCVyEQcL0z9DFN3wmuGqt6P9I5gffDx4Jvr9DoUgt"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-d87672.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-18rV5NWB60xjXDy3F_JtRCVyEQcL0z9DFN3wmuGqt6P9I5gffDx4Jvr9DoUgt\"}"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d87672.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"c9602860-9aba-4cd6-bdbb-1f1653ac44fb","keyName":"e2e-rate-b-64664b","subscription":"e2e-rate-iso-b-64664b","tenant":"e2e-shared-b-d87672","userId":"c9602860-9aba-4cd6-bdbb-1f1653ac44fb","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-d87672.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-d87672/rate-test-model-d87672\",\"requestedSubscription\":\"e2e-rate-iso-b-64664b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-d87672.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-d87672","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-64664b","namespace":"ai-tenant-e2e-shared-b-d87672","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-d87672/rate-test-model-d87672\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-64664b"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"c9602860-9aba-4cd6-bdbb-1f1653ac44fb","keyName":"e2e-rate-b-64664b","selected_subscription":"e2e-rate-iso-b-64664b","selected_subscription_key":"ai-tenant-e2e-shared-b-d87672/e2e-rate-iso-b-64664b@ai-tenant-e2e-shared-b-d87672/rate-test-model-d87672","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-d87672","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-64664b","namespace":"ai-tenant-e2e-shared-b-d87672","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea1d10f0-91d5-4fd6-95d1-6caeac18356d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34172","PortSpecifier":{"PortValue":34172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0329b108-52e2-409c-a0a4-88e7588fb79e","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34172","PortSpecifier":{"PortValue":34172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":589524688},"http":{"id":"0329b108-52e2-409c-a0a4-88e7588fb79e","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014003,"groups":["Engineering","Project-Alpha"],"iat":1783013943,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:aef515a3-6f80-b655-6797-12b2ea03ae30","preferred_username":"alice_lead","scope":"email profile","sid":"WlQxmH2kFuzanaP5xvemQhDN","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014003,"groups":["Engineering","Project-Alpha"],"iat":1783013943,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:aef515a3-6f80-b655-6797-12b2ea03ae30","preferred_username":"alice_lead","scope":"email profile","sid":"WlQxmH2kFuzanaP5xvemQhDN","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34182","PortSpecifier":{"PortValue":34182}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2a5096db-b755-4e56-a782-f80b82ebeff2","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34182","PortSpecifier":{"PortValue":34182}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":719072220},"http":{"id":"2a5096db-b755-4e56-a782-f80b82ebeff2","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34190","PortSpecifier":{"PortValue":34190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34190","PortSpecifier":{"PortValue":34190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":794595647},"http":{"id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer","content-length":"35","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.11","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.133.0.11","x-forwarded-host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93"},"path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"credential not found"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34192","PortSpecifier":{"PortValue":34192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34192","PortSpecifier":{"PortValue":34192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":824652172},"http":{"id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","content-length":"36","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.11","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.133.0.11","x-forwarded-host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2"},"path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34202","PortSpecifier":{"PortValue":34202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6df054e7-093a-461d-8519-dbf1c72d347c","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34202","PortSpecifier":{"PortValue":34202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":920293459},"http":{"id":"6df054e7-093a-461d-8519-dbf1c72d347c","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-02 16:39:03 +0000 UTC)"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/888fdad5bc63ac36546012ce97b2af4b7b1a45ef243fd2eba72f12c306f06e3e","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a124e7db3701742524b9534a4ba1eb68cc6d8f337ccc26c3f8f17b958cc795d0","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/30c4b39450ec876cfb2b0e66cbea2a74b7bcfafcf83d80a94c503487492e5a48","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/98dd9311f361e75de96f77b800598c9f5c79c7fa539cfd493b5f7631f8efab90","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a394737442ca47bfbcb906bcf34d05c5515587984942470db6d6858608ab543a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/98b96558d098c10ea5cd4b877712861a71c554909b27785cf9b672cf28954a5a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/305bde7d554d0d2810b101d2b8d4e0e15521c2afbf16166555b8e9aa4ed39a3d","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f9a2a1e13eaadb4f450e63a68a3d05ec02a537019380f832f5992d1c5cdee533","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c098209e055107073c6ded1d63e221315c2239f3cf17a7d15056a7494c5714fb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3d32277ea538e86091b57e14fc6f6582cbe1daa3e7e81223282a75b03a512083","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/707878bcd632125ecab845de29fc41570ff2eb882a04dea05a2e77c0ea6d31f9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d66f5b12bbb76f83ef1cb89313ae7356d9a4c974f276c1405eefa0cb8d66ceda","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4325b2a5e55bf181d1f503f5c3cbce3259c00ca301216d4ea5bc6b962627f1bd","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/101d9a4d9b715268b3a3623fb114473501068b7352d534f324f4a3121b535746","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/452d598a0ad1047944cd02d3654e6793847781ecc87763544a69e05020a86cf3","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1ef3f8313d73a7c14b76ea704cc3f23f015b2ab50034887cf570208a050e9863","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/630f18b14e5ce0234d4da773011770ac52ec305a1af3397f72696bf5262056bb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3774b789b89cb794db9f2ae5a4e410c6a000c480af86f9e4466977b4dc7de25a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f3df6834dcf2df14d188decd66432f3940127e3a8261065cd3a44bd9ed1db6d","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd452b3491b4064e772f38d1a288406bb3889f19efd54af26f6554f07046a8c0","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ba8750633b915855593e941d13c912f4f6c6d6c6a659c241b67d178bbe85f188","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/47d4519f979dd8b06fb3b12ecf63e079887e8b64c789a1ff79b4c429f3a6aa2a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e9607d3c9394ff787a7cb9306c470b1007979008e27c6d6c68281553a4653faa","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54288","PortSpecifier":{"PortValue":54288}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54288","PortSpecifier":{"PortValue":54288}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":83439109},"http":{"id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-02 17:40:03 +0000 UTC)"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54296","PortSpecifier":{"PortValue":54296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54296","PortSpecifier":{"PortValue":54296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":475121463},"http":{"id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Site-Reliability"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:290fccbc-8616-3fd3-31a9-339ce2c866e8","preferred_username":"bob_sre","scope":"email profile","sid":"0dg-lmrHZNfBWQC5CI21a9TR","sub":"43188c19-4b62-4988-90bf-ebe3c1a01abb","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Site-Reliability"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:290fccbc-8616-3fd3-31a9-339ce2c866e8","preferred_username":"bob_sre","scope":"email profile","sid":"0dg-lmrHZNfBWQC5CI21a9TR","sub":"43188c19-4b62-4988-90bf-ebe3c1a01abb","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54310","PortSpecifier":{"PortValue":54310}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"745bc3a6-1511-4463-a58f-7b82329f78ac","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54310","PortSpecifier":{"PortValue":54310}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":704229040},"http":{"id":"745bc3a6-1511-4463-a58f-7b82329f78ac","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:8305fcff-3df8-8783-b163-61c7985e59e5","preferred_username":"alice_lead","scope":"email profile","sid":"QPN4vMFejprz1cFlGZ1ETCrn","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:8305fcff-3df8-8783-b163-61c7985e59e5","preferred_username":"alice_lead","scope":"email profile","sid":"QPN4vMFejprz1cFlGZ1ETCrn","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54322","PortSpecifier":{"PortValue":54322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ca169c26-9775-4a16-88f6-51d7b22837e4","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54322","PortSpecifier":{"PortValue":54322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":739984568},"http":{"id":"ca169c26-9775-4a16-88f6-51d7b22837e4","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","keyName":"e2e-oidc-8a4b0d50","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":768643988},"http":{"id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","keyName":"e2e-oidc-8a4b0d50","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.35","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":768643988,"seconds":1783014008},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.35:53926","port":53926}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","keyName":"e2e-oidc-8a4b0d50","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54330","PortSpecifier":{"PortValue":54330}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54330","PortSpecifier":{"PortValue":54330}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":808263207},"http":{"id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","keyName":"e2e-oidc-8a4b0d50","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","keyName":"e2e-oidc-8a4b0d50","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54336","PortSpecifier":{"PortValue":54336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54336","PortSpecifier":{"PortValue":54336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":914286733},"http":{"id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1ff495d7-e0c2-9762-6e5b-3dfb35de5074","preferred_username":"alice_lead","scope":"email profile","sid":"NDAq9W8_1-fYyNt-wGT0vHmP","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1ff495d7-e0c2-9762-6e5b-3dfb35de5074","preferred_username":"alice_lead","scope":"email profile","sid":"NDAq9W8_1-fYyNt-wGT0vHmP","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54344","PortSpecifier":{"PortValue":54344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","method":"DELETE","path":"/maas-api/v1/api-keys/ae5705a8-207f-4d52-9493-b7a7eaa005dd","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54344","PortSpecifier":{"PortValue":54344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":949666654},"http":{"id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","method":"DELETE","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/ae5705a8-207f-4d52-9493-b7a7eaa005dd",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1ff495d7-e0c2-9762-6e5b-3dfb35de5074","preferred_username":"alice_lead","scope":"email profile","sid":"NDAq9W8_1-fYyNt-wGT0vHmP","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1ff495d7-e0c2-9762-6e5b-3dfb35de5074","preferred_username":"alice_lead","scope":"email profile","sid":"NDAq9W8_1-fYyNt-wGT0vHmP","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/ae5705a8-207f-4d52-9493-b7a7eaa005dd",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57447a00-306a-435c-a0e4-c83096ce835e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54356","PortSpecifier":{"PortValue":54356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"57447a00-306a-435c-a0e4-c83096ce835e","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57447a00-306a-435c-a0e4-c83096ce835e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54356","PortSpecifier":{"PortValue":54356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":983793740},"http":{"id":"57447a00-306a-435c-a0e4-c83096ce835e","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"57447a00-306a-435c-a0e4-c83096ce835e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-bRS28tlNpN7aBHgO_uGRnQaeWGpMACliO1ydyi5JTcjnGqqe683lPoLRMlrh"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"57447a00-306a-435c-a0e4-c83096ce835e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-bRS28tlNpN7aBHgO_uGRnQaeWGpMACliO1ydyi5JTcjnGqqe683lPoLRMlrh\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"57447a00-306a-435c-a0e4-c83096ce835e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"57447a00-306a-435c-a0e4-c83096ce835e","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"57447a00-306a-435c-a0e4-c83096ce835e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57447a00-306a-435c-a0e4-c83096ce835e","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57447a00-306a-435c-a0e4-c83096ce835e","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54366","PortSpecifier":{"PortValue":54366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fae887a6-2876-4abc-890f-ac3226e9947a","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54366","PortSpecifier":{"PortValue":54366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":13816917},"http":{"id":"fae887a6-2876-4abc-890f-ac3226e9947a","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-bRS28tlNpN7aBHgO_uGRnQaeWGpMACliO1ydyi5JTcjnGqqe683lPoLRMlrh"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-bRS28tlNpN7aBHgO_uGRnQaeWGpMACliO1ydyi5JTcjnGqqe683lPoLRMlrh\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54370","PortSpecifier":{"PortValue":54370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b098427-d509-453a-8108-92f3bf43e2e9","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54370","PortSpecifier":{"PortValue":54370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":139030390},"http":{"id":"0b098427-d509-453a-8108-92f3bf43e2e9","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54386","PortSpecifier":{"PortValue":54386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d6ed225f-94cc-437a-a911-36b12ad61f37","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54386","PortSpecifier":{"PortValue":54386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":312206755},"http":{"id":"d6ed225f-94cc-437a-a911-36b12ad61f37","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:70a8f4bd-89e3-20ba-9910-b09baa1f6c0c","preferred_username":"alice_lead","scope":"email profile","sid":"RU6ThNJvJLbLibPIdxLEP59W","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:70a8f4bd-89e3-20ba-9910-b09baa1f6c0c","preferred_username":"alice_lead","scope":"email profile","sid":"RU6ThNJvJLbLibPIdxLEP59W","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54390","PortSpecifier":{"PortValue":54390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54390","PortSpecifier":{"PortValue":54390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":342760529},"http":{"id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Site-Reliability"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:30809923-8014-9a30-57e5-42828953939e","preferred_username":"bob_sre","scope":"email profile","sid":"wZElRYgojFuKKzhr9pn9W06m","sub":"43188c19-4b62-4988-90bf-ebe3c1a01abb","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Site-Reliability"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:30809923-8014-9a30-57e5-42828953939e","preferred_username":"bob_sre","scope":"email profile","sid":"wZElRYgojFuKKzhr9pn9W06m","sub":"43188c19-4b62-4988-90bf-ebe3c1a01abb","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54398","PortSpecifier":{"PortValue":54398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"224672e4-9f19-490a-b630-9e2e76f5118e","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54398","PortSpecifier":{"PortValue":54398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":438784421},"http":{"id":"224672e4-9f19-490a-b630-9e2e76f5118e","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54408","PortSpecifier":{"PortValue":54408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7eae8051-b78c-4b62-9a19-f7bb93126749","method":"DELETE","path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54408","PortSpecifier":{"PortValue":54408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":470034332},"http":{"id":"7eae8051-b78c-4b62-9a19-f7bb93126749","method":"DELETE","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54416","PortSpecifier":{"PortValue":54416}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","method":"DELETE","path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54416","PortSpecifier":{"PortValue":54416}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":502245562},"http":{"id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","method":"DELETE","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54426","PortSpecifier":{"PortValue":54426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54426","PortSpecifier":{"PortValue":54426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":597836964},"http":{"id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:5d017769-9694-036a-273d-519a96e6cd15","preferred_username":"alice_lead","scope":"email profile","sid":"2dmtkSuUGxEL20X-7Gdr1OzU","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:5d017769-9694-036a-273d-519a96e6cd15","preferred_username":"alice_lead","scope":"email profile","sid":"2dmtkSuUGxEL20X-7Gdr1OzU","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54430","PortSpecifier":{"PortValue":54430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"148ca765-798b-4512-bea4-29ce5eb8988a","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54430","PortSpecifier":{"PortValue":54430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":632916382},"http":{"id":"148ca765-798b-4512-bea4-29ce5eb8988a","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-15If5ZwouR7Imh7iJ_WbeWMj0HN6A8LAx9vit5xhkYIlZrUyQNlduTAgaDdTC"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-15If5ZwouR7Imh7iJ_WbeWMj0HN6A8LAx9vit5xhkYIlZrUyQNlduTAgaDdTC\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"423e757c-5460-452b-b63f-47d315a52caa","keyName":"e2e-oidc-17054549","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"423e757c-5460-452b-b63f-47d315a52caa","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":641060703},"http":{"id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-15If5ZwouR7Imh7iJ_WbeWMj0HN6A8LAx9vit5xhkYIlZrUyQNlduTAgaDdTC"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-15If5ZwouR7Imh7iJ_WbeWMj0HN6A8LAx9vit5xhkYIlZrUyQNlduTAgaDdTC\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"423e757c-5460-452b-b63f-47d315a52caa","keyName":"e2e-oidc-17054549","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"423e757c-5460-452b-b63f-47d315a52caa","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-15If5ZwouR7Imh7iJ_WbeWMj0HN6A8LAx9vit5xhkYIlZrUyQNlduTAgaDdTC","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.35","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":641060703,"seconds":1783014009},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.35:53926","port":53926}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"423e757c-5460-452b-b63f-47d315a52caa","keyName":"e2e-oidc-17054549","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74898a71-7660-4489-9ee2-bc4f049db185","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54440","PortSpecifier":{"PortValue":54440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74898a71-7660-4489-9ee2-bc4f049db185","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74898a71-7660-4489-9ee2-bc4f049db185","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54440","PortSpecifier":{"PortValue":54440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":737278941},"http":{"id":"74898a71-7660-4489-9ee2-bc4f049db185","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:afa288de-bac2-7c1d-7662-2a3d1a5a5839","preferred_username":"alice_lead","scope":"email profile","sid":"CvWBxtWwdbIJek3V22nmMXw5","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74898a71-7660-4489-9ee2-bc4f049db185","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:afa288de-bac2-7c1d-7662-2a3d1a5a5839","preferred_username":"alice_lead","scope":"email profile","sid":"CvWBxtWwdbIJek3V22nmMXw5","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74898a71-7660-4489-9ee2-bc4f049db185","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74898a71-7660-4489-9ee2-bc4f049db185","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1403900-c105-4619-80b6-651a199df01d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54442","PortSpecifier":{"PortValue":54442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1403900-c105-4619-80b6-651a199df01d","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1403900-c105-4619-80b6-651a199df01d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54442","PortSpecifier":{"PortValue":54442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":770825129},"http":{"id":"a1403900-c105-4619-80b6-651a199df01d","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1403900-c105-4619-80b6-651a199df01d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"253238ab-2d98-48de-8df6-2de7ac011d25","keyName":"e2e-oidc-39f73d48","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"253238ab-2d98-48de-8df6-2de7ac011d25","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1403900-c105-4619-80b6-651a199df01d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1403900-c105-4619-80b6-651a199df01d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1403900-c105-4619-80b6-651a199df01d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3e63980-b5f3-4754-822c-600487409609","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54444","PortSpecifier":{"PortValue":54444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b3e63980-b5f3-4754-822c-600487409609","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3e63980-b5f3-4754-822c-600487409609","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54444","PortSpecifier":{"PortValue":54444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":799020279},"http":{"id":"b3e63980-b5f3-4754-822c-600487409609","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b3e63980-b5f3-4754-822c-600487409609","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"253238ab-2d98-48de-8df6-2de7ac011d25","keyName":"e2e-oidc-39f73d48","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"253238ab-2d98-48de-8df6-2de7ac011d25","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b3e63980-b5f3-4754-822c-600487409609","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3e63980-b5f3-4754-822c-600487409609","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3e63980-b5f3-4754-822c-600487409609","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84e295db-a0cb-44a0-acfe-35b5a345b159","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":807108427},"http":{"id":"84e295db-a0cb-44a0-acfe-35b5a345b159","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"253238ab-2d98-48de-8df6-2de7ac011d25","keyName":"e2e-oidc-39f73d48","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"253238ab-2d98-48de-8df6-2de7ac011d25","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.35","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"84e295db-a0cb-44a0-acfe-35b5a345b159"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"84e295db-a0cb-44a0-acfe-35b5a345b159","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":807108427,"seconds":1783014009},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.35:53926","port":53926}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"253238ab-2d98-48de-8df6-2de7ac011d25","keyName":"e2e-oidc-39f73d48","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54456","PortSpecifier":{"PortValue":54456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54456","PortSpecifier":{"PortValue":54456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":907529216},"http":{"id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:74483976-e1ba-7f2d-bf64-5b436a682140","preferred_username":"alice_lead","scope":"email profile","sid":"Gm5rwZX29w1y8tFzz-q8ms-l","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:74483976-e1ba-7f2d-bf64-5b436a682140","preferred_username":"alice_lead","scope":"email profile","sid":"Gm5rwZX29w1y8tFzz-q8ms-l","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54462","PortSpecifier":{"PortValue":54462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54462","PortSpecifier":{"PortValue":54462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":938363533},"http":{"id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"dac17806-b6ed-44da-b71d-8e33759d0198","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b72b807c-459a-4a4f-ba90-6da4c120b581","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":946307237},"http":{"id":"b72b807c-459a-4a4f-ba90-6da4c120b581","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"dac17806-b6ed-44da-b71d-8e33759d0198","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.35","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b72b807c-459a-4a4f-ba90-6da4c120b581"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b72b807c-459a-4a4f-ba90-6da4c120b581","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":946307237,"seconds":1783014009},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.35:53926","port":53926}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54478","PortSpecifier":{"PortValue":54478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54478","PortSpecifier":{"PortValue":54478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":978572710},"http":{"id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"dac17806-b6ed-44da-b71d-8e33759d0198","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bd36291-9b15-473a-9223-36274397b395","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9bd36291-9b15-473a-9223-36274397b395","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bd36291-9b15-473a-9223-36274397b395","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":985553743},"http":{"id":"9bd36291-9b15-473a-9223-36274397b395","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9bd36291-9b15-473a-9223-36274397b395","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"dac17806-b6ed-44da-b71d-8e33759d0198","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9bd36291-9b15-473a-9223-36274397b395","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9bd36291-9b15-473a-9223-36274397b395","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.35","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9bd36291-9b15-473a-9223-36274397b395"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9bd36291-9b15-473a-9223-36274397b395","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":985553743,"seconds":1783014009},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.35:53926","port":53926}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bd36291-9b15-473a-9223-36274397b395","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bd36291-9b15-473a-9223-36274397b395","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54480","PortSpecifier":{"PortValue":54480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a642c50d-046e-43f0-b134-3990384b1fa6","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54480","PortSpecifier":{"PortValue":54480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014010,"nanos":83963920},"http":{"id":"a642c50d-046e-43f0-b134-3990384b1fa6","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014070,"groups":["Engineering","Project-Alpha"],"iat":1783014010,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:70d0c24f-380a-4c7f-91bc-8fb32ba4b2de","preferred_username":"alice_lead","scope":"email profile","sid":"bTqB1djWf_34n5RKRkNtayT4","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014070,"groups":["Engineering","Project-Alpha"],"iat":1783014010,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:70d0c24f-380a-4c7f-91bc-8fb32ba4b2de","preferred_username":"alice_lead","scope":"email profile","sid":"bTqB1djWf_34n5RKRkNtayT4","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092"}
{"level":"info","ts":"2026-07-02T17:40:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b87ae20be634e7941a82681131b84d2144485c86ddbf9a8d229325d7b1c9c657"}
{"level":"info","ts":"2026-07-02T17:40:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dda0fffe0e9844459121fff00307415c1bacf5fadfde9732208445b2ade76dd2"}
{"level":"info","ts":"2026-07-02T17:40:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d"}