{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0329b108-52e2-409c-a0a4-88e7588fb79e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34182","PortSpecifier":{"PortValue":34182}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2a5096db-b755-4e56-a782-f80b82ebeff2","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34182","PortSpecifier":{"PortValue":34182}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":719072220},"http":{"id":"2a5096db-b755-4e56-a782-f80b82ebeff2","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a5096db-b755-4e56-a782-f80b82ebeff2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34190","PortSpecifier":{"PortValue":34190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34190","PortSpecifier":{"PortValue":34190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":794595647},"http":{"id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer","content-length":"35","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.11","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.133.0.11","x-forwarded-host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93"},"path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"credential not found"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e25277e-0676-4b01-a009-9c3e6f6a6f93","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34192","PortSpecifier":{"PortValue":34192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34192","PortSpecifier":{"PortValue":34192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":824652172},"http":{"id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","content-length":"36","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.11","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.133.0.11","x-forwarded-host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2"},"path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c790aa7-3ce4-4797-8dc7-487edcda0db2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34202","PortSpecifier":{"PortValue":34202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6df054e7-093a-461d-8519-dbf1c72d347c","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:34202","PortSpecifier":{"PortValue":34202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783013943,"nanos":920293459},"http":{"id":"6df054e7-093a-461d-8519-dbf1c72d347c","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-02 16:39:03 +0000 UTC)"}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:39:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6df054e7-093a-461d-8519-dbf1c72d347c","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cd508f1586a587ce16921ba573b85b7c39b78feae947601fedad236d28c0582a"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b4f7528b8429fdd1c4fc33d8a661342dece651a0cf7fa717ff9d8fda99091b30"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9a1ffcbebcb3c1e767002ce98b530598a14032b1a1f6c8048ece36a8ddf88966"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b362387de48cda98e81d72cda9c3c1c98fb24e4f64153829bf336dd051286b57"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85ffbf30daa1777938d4afcf06d0147afb108307263f8125d5ab624dc3c4cb68"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5c58a886ac35572582acd8de33ae24a6c6f993d6b4d65f8f0caf0baa2d1317fa"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/799b94e259bf5c648ed3735aeba6824194415f3fc09858fd220567ed9ea4f325"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8e5df0d4f4a6c1e90efeb091a2120f30cd3f448b312dac5cec62a16c1d70fe89"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9c24fdc27f531c87af987eca2411927f6ca014a9d917e8dd6274d1cf1620c9a9"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5c0827e90602237e61eec0074757f623751ad820c13482513f52b16b588cefdb"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/128acfb5916b93b6f0ec207c5a5c1dd24f152dca7d86cb2bb440682229e4c2e8"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a1a0d92fa5dd5f0aa15134731e7c9919aff9ee909df6390246a36f022da54884"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d14918621cb54758cb6d39a0601acf673b162501f0835a0fe135810168255eca"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7401d7e8cf98819db69dd93e81c59b30a97c6c2bfa4771ec178bf8b52bbbd5ee"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9d57cbb4ab4dada3d6499e46177866d6ab7c058b37accd1997e5afe5696dd4d7"}
{"level":"info","ts":"2026-07-02T17:39:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aca141fbff4ced91d648f04af6f46a0421f35efde7d2dacd41f0448bb92b4338"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/888fdad5bc63ac36546012ce97b2af4b7b1a45ef243fd2eba72f12c306f06e3e","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a124e7db3701742524b9534a4ba1eb68cc6d8f337ccc26c3f8f17b958cc795d0","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/30c4b39450ec876cfb2b0e66cbea2a74b7bcfafcf83d80a94c503487492e5a48","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/98dd9311f361e75de96f77b800598c9f5c79c7fa539cfd493b5f7631f8efab90","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a394737442ca47bfbcb906bcf34d05c5515587984942470db6d6858608ab543a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/98b96558d098c10ea5cd4b877712861a71c554909b27785cf9b672cf28954a5a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/305bde7d554d0d2810b101d2b8d4e0e15521c2afbf16166555b8e9aa4ed39a3d","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f9a2a1e13eaadb4f450e63a68a3d05ec02a537019380f832f5992d1c5cdee533","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c098209e055107073c6ded1d63e221315c2239f3cf17a7d15056a7494c5714fb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3d32277ea538e86091b57e14fc6f6582cbe1daa3e7e81223282a75b03a512083","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/707878bcd632125ecab845de29fc41570ff2eb882a04dea05a2e77c0ea6d31f9","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d66f5b12bbb76f83ef1cb89313ae7356d9a4c974f276c1405eefa0cb8d66ceda","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4325b2a5e55bf181d1f503f5c3cbce3259c00ca301216d4ea5bc6b962627f1bd","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/101d9a4d9b715268b3a3623fb114473501068b7352d534f324f4a3121b535746","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/452d598a0ad1047944cd02d3654e6793847781ecc87763544a69e05020a86cf3","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1ef3f8313d73a7c14b76ea704cc3f23f015b2ab50034887cf570208a050e9863","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/630f18b14e5ce0234d4da773011770ac52ec305a1af3397f72696bf5262056bb","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3774b789b89cb794db9f2ae5a4e410c6a000c480af86f9e4466977b4dc7de25a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f3df6834dcf2df14d188decd66432f3940127e3a8261065cd3a44bd9ed1db6d","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd452b3491b4064e772f38d1a288406bb3889f19efd54af26f6554f07046a8c0","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ba8750633b915855593e941d13c912f4f6c6d6c6a659c241b67d178bbe85f188","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/47d4519f979dd8b06fb3b12ecf63e079887e8b64c789a1ff79b4c429f3a6aa2a","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e9607d3c9394ff787a7cb9306c470b1007979008e27c6d6c68281553a4653faa","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-02T17:39:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54288","PortSpecifier":{"PortValue":54288}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54288","PortSpecifier":{"PortValue":54288}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":83439109},"http":{"id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-02 17:40:03 +0000 UTC)"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df235716-6bdc-4e4e-aef5-dfb117da91d9","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54296","PortSpecifier":{"PortValue":54296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54296","PortSpecifier":{"PortValue":54296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":475121463},"http":{"id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Site-Reliability"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:290fccbc-8616-3fd3-31a9-339ce2c866e8","preferred_username":"bob_sre","scope":"email profile","sid":"0dg-lmrHZNfBWQC5CI21a9TR","sub":"43188c19-4b62-4988-90bf-ebe3c1a01abb","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Site-Reliability"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:290fccbc-8616-3fd3-31a9-339ce2c866e8","preferred_username":"bob_sre","scope":"email profile","sid":"0dg-lmrHZNfBWQC5CI21a9TR","sub":"43188c19-4b62-4988-90bf-ebe3c1a01abb","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e144684-cc0a-4611-9b67-6ff67fb5380b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54310","PortSpecifier":{"PortValue":54310}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"745bc3a6-1511-4463-a58f-7b82329f78ac","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54310","PortSpecifier":{"PortValue":54310}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":704229040},"http":{"id":"745bc3a6-1511-4463-a58f-7b82329f78ac","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:8305fcff-3df8-8783-b163-61c7985e59e5","preferred_username":"alice_lead","scope":"email profile","sid":"QPN4vMFejprz1cFlGZ1ETCrn","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:8305fcff-3df8-8783-b163-61c7985e59e5","preferred_username":"alice_lead","scope":"email profile","sid":"QPN4vMFejprz1cFlGZ1ETCrn","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"745bc3a6-1511-4463-a58f-7b82329f78ac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54322","PortSpecifier":{"PortValue":54322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ca169c26-9775-4a16-88f6-51d7b22837e4","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54322","PortSpecifier":{"PortValue":54322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":739984568},"http":{"id":"ca169c26-9775-4a16-88f6-51d7b22837e4","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","keyName":"e2e-oidc-8a4b0d50","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ca169c26-9775-4a16-88f6-51d7b22837e4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":768643988},"http":{"id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","keyName":"e2e-oidc-8a4b0d50","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.35","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":768643988,"seconds":1783014008},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.35:53926","port":53926}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","keyName":"e2e-oidc-8a4b0d50","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"da2c7f05-6d2b-4c72-b1e6-3b91d6629085","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54330","PortSpecifier":{"PortValue":54330}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54330","PortSpecifier":{"PortValue":54330}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":808263207},"http":{"id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-7pydVXKeXyAwBfJ5_IfxPdltNFQNB15lR1O3PYAQ2TDnnqkVgpuxaYlImrer\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","keyName":"e2e-oidc-8a4b0d50","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"9c2fc652-4628-4e0e-9cbe-15a3ccc6a936","keyName":"e2e-oidc-8a4b0d50","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4a2d2fd6-f3b3-4822-b464-bf956eab1ded","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54336","PortSpecifier":{"PortValue":54336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54336","PortSpecifier":{"PortValue":54336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":914286733},"http":{"id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1ff495d7-e0c2-9762-6e5b-3dfb35de5074","preferred_username":"alice_lead","scope":"email profile","sid":"NDAq9W8_1-fYyNt-wGT0vHmP","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1ff495d7-e0c2-9762-6e5b-3dfb35de5074","preferred_username":"alice_lead","scope":"email profile","sid":"NDAq9W8_1-fYyNt-wGT0vHmP","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"369e82ed-bef1-413f-bca2-6d68a5af68d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54344","PortSpecifier":{"PortValue":54344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","method":"DELETE","path":"/maas-api/v1/api-keys/ae5705a8-207f-4d52-9493-b7a7eaa005dd","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54344","PortSpecifier":{"PortValue":54344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":949666654},"http":{"id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","method":"DELETE","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/ae5705a8-207f-4d52-9493-b7a7eaa005dd",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1ff495d7-e0c2-9762-6e5b-3dfb35de5074","preferred_username":"alice_lead","scope":"email profile","sid":"NDAq9W8_1-fYyNt-wGT0vHmP","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014068,"groups":["Engineering","Project-Alpha"],"iat":1783014008,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:1ff495d7-e0c2-9762-6e5b-3dfb35de5074","preferred_username":"alice_lead","scope":"email profile","sid":"NDAq9W8_1-fYyNt-wGT0vHmP","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/ae5705a8-207f-4d52-9493-b7a7eaa005dd",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"69a4ca19-623c-449d-bc22-b5b4392f5c2c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57447a00-306a-435c-a0e4-c83096ce835e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54356","PortSpecifier":{"PortValue":54356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"57447a00-306a-435c-a0e4-c83096ce835e","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57447a00-306a-435c-a0e4-c83096ce835e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54356","PortSpecifier":{"PortValue":54356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014008,"nanos":983793740},"http":{"id":"57447a00-306a-435c-a0e4-c83096ce835e","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"57447a00-306a-435c-a0e4-c83096ce835e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-bRS28tlNpN7aBHgO_uGRnQaeWGpMACliO1ydyi5JTcjnGqqe683lPoLRMlrh"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"57447a00-306a-435c-a0e4-c83096ce835e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-bRS28tlNpN7aBHgO_uGRnQaeWGpMACliO1ydyi5JTcjnGqqe683lPoLRMlrh\"}"}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"57447a00-306a-435c-a0e4-c83096ce835e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"57447a00-306a-435c-a0e4-c83096ce835e","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"57447a00-306a-435c-a0e4-c83096ce835e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57447a00-306a-435c-a0e4-c83096ce835e","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-02T17:40:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57447a00-306a-435c-a0e4-c83096ce835e","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54366","PortSpecifier":{"PortValue":54366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fae887a6-2876-4abc-890f-ac3226e9947a","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54366","PortSpecifier":{"PortValue":54366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":13816917},"http":{"id":"fae887a6-2876-4abc-890f-ac3226e9947a","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-bRS28tlNpN7aBHgO_uGRnQaeWGpMACliO1ydyi5JTcjnGqqe683lPoLRMlrh"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-bRS28tlNpN7aBHgO_uGRnQaeWGpMACliO1ydyi5JTcjnGqqe683lPoLRMlrh\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fae887a6-2876-4abc-890f-ac3226e9947a","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54370","PortSpecifier":{"PortValue":54370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b098427-d509-453a-8108-92f3bf43e2e9","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54370","PortSpecifier":{"PortValue":54370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":139030390},"http":{"id":"0b098427-d509-453a-8108-92f3bf43e2e9","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b098427-d509-453a-8108-92f3bf43e2e9","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54386","PortSpecifier":{"PortValue":54386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d6ed225f-94cc-437a-a911-36b12ad61f37","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54386","PortSpecifier":{"PortValue":54386}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":312206755},"http":{"id":"d6ed225f-94cc-437a-a911-36b12ad61f37","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:70a8f4bd-89e3-20ba-9910-b09baa1f6c0c","preferred_username":"alice_lead","scope":"email profile","sid":"RU6ThNJvJLbLibPIdxLEP59W","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:70a8f4bd-89e3-20ba-9910-b09baa1f6c0c","preferred_username":"alice_lead","scope":"email profile","sid":"RU6ThNJvJLbLibPIdxLEP59W","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6ed225f-94cc-437a-a911-36b12ad61f37","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54390","PortSpecifier":{"PortValue":54390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54390","PortSpecifier":{"PortValue":54390}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":342760529},"http":{"id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Site-Reliability"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:30809923-8014-9a30-57e5-42828953939e","preferred_username":"bob_sre","scope":"email profile","sid":"wZElRYgojFuKKzhr9pn9W06m","sub":"43188c19-4b62-4988-90bf-ebe3c1a01abb","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Site-Reliability"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:30809923-8014-9a30-57e5-42828953939e","preferred_username":"bob_sre","scope":"email profile","sid":"wZElRYgojFuKKzhr9pn9W06m","sub":"43188c19-4b62-4988-90bf-ebe3c1a01abb","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6603bef1-f12a-4cc7-bbf4-0878ba274f9a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54398","PortSpecifier":{"PortValue":54398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"224672e4-9f19-490a-b630-9e2e76f5118e","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54398","PortSpecifier":{"PortValue":54398}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":438784421},"http":{"id":"224672e4-9f19-490a-b630-9e2e76f5118e","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"224672e4-9f19-490a-b630-9e2e76f5118e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54408","PortSpecifier":{"PortValue":54408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7eae8051-b78c-4b62-9a19-f7bb93126749","method":"DELETE","path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54408","PortSpecifier":{"PortValue":54408}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":470034332},"http":{"id":"7eae8051-b78c-4b62-9a19-f7bb93126749","method":"DELETE","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7eae8051-b78c-4b62-9a19-f7bb93126749","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54416","PortSpecifier":{"PortValue":54416}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","method":"DELETE","path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54416","PortSpecifier":{"PortValue":54416}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":502245562},"http":{"id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","method":"DELETE","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:7c558e5d-5992-7a51-215f-8885dca4e3f1","preferred_username":"alice_lead","scope":"email profile","sid":"-abBObPPxOaV8LcQWapLheio","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/49d40c49-2d6d-4314-a654-a70c1bb20d83",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1b9ccc3-171c-41f5-ba16-fbb0ba1cf622","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54426","PortSpecifier":{"PortValue":54426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54426","PortSpecifier":{"PortValue":54426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":597836964},"http":{"id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:5d017769-9694-036a-273d-519a96e6cd15","preferred_username":"alice_lead","scope":"email profile","sid":"2dmtkSuUGxEL20X-7Gdr1OzU","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:5d017769-9694-036a-273d-519a96e6cd15","preferred_username":"alice_lead","scope":"email profile","sid":"2dmtkSuUGxEL20X-7Gdr1OzU","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08baf62d-eeef-4111-b3ed-a5b13fedc796","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54430","PortSpecifier":{"PortValue":54430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"148ca765-798b-4512-bea4-29ce5eb8988a","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54430","PortSpecifier":{"PortValue":54430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":632916382},"http":{"id":"148ca765-798b-4512-bea4-29ce5eb8988a","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-15If5ZwouR7Imh7iJ_WbeWMj0HN6A8LAx9vit5xhkYIlZrUyQNlduTAgaDdTC"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-15If5ZwouR7Imh7iJ_WbeWMj0HN6A8LAx9vit5xhkYIlZrUyQNlduTAgaDdTC\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"423e757c-5460-452b-b63f-47d315a52caa","keyName":"e2e-oidc-17054549","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"423e757c-5460-452b-b63f-47d315a52caa","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"148ca765-798b-4512-bea4-29ce5eb8988a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":641060703},"http":{"id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-15If5ZwouR7Imh7iJ_WbeWMj0HN6A8LAx9vit5xhkYIlZrUyQNlduTAgaDdTC"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-15If5ZwouR7Imh7iJ_WbeWMj0HN6A8LAx9vit5xhkYIlZrUyQNlduTAgaDdTC\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"423e757c-5460-452b-b63f-47d315a52caa","keyName":"e2e-oidc-17054549","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"423e757c-5460-452b-b63f-47d315a52caa","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-15If5ZwouR7Imh7iJ_WbeWMj0HN6A8LAx9vit5xhkYIlZrUyQNlduTAgaDdTC","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.35","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":641060703,"seconds":1783014009},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.35:53926","port":53926}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"423e757c-5460-452b-b63f-47d315a52caa","keyName":"e2e-oidc-17054549","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fdf168a-e3b2-4e9c-83c3-f795532501c1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74898a71-7660-4489-9ee2-bc4f049db185","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54440","PortSpecifier":{"PortValue":54440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74898a71-7660-4489-9ee2-bc4f049db185","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74898a71-7660-4489-9ee2-bc4f049db185","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54440","PortSpecifier":{"PortValue":54440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":737278941},"http":{"id":"74898a71-7660-4489-9ee2-bc4f049db185","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:afa288de-bac2-7c1d-7662-2a3d1a5a5839","preferred_username":"alice_lead","scope":"email profile","sid":"CvWBxtWwdbIJek3V22nmMXw5","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74898a71-7660-4489-9ee2-bc4f049db185","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:afa288de-bac2-7c1d-7662-2a3d1a5a5839","preferred_username":"alice_lead","scope":"email profile","sid":"CvWBxtWwdbIJek3V22nmMXw5","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74898a71-7660-4489-9ee2-bc4f049db185","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74898a71-7660-4489-9ee2-bc4f049db185","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74898a71-7660-4489-9ee2-bc4f049db185","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1403900-c105-4619-80b6-651a199df01d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54442","PortSpecifier":{"PortValue":54442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1403900-c105-4619-80b6-651a199df01d","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1403900-c105-4619-80b6-651a199df01d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54442","PortSpecifier":{"PortValue":54442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":770825129},"http":{"id":"a1403900-c105-4619-80b6-651a199df01d","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1403900-c105-4619-80b6-651a199df01d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"253238ab-2d98-48de-8df6-2de7ac011d25","keyName":"e2e-oidc-39f73d48","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"253238ab-2d98-48de-8df6-2de7ac011d25","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1403900-c105-4619-80b6-651a199df01d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a1403900-c105-4619-80b6-651a199df01d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1403900-c105-4619-80b6-651a199df01d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1403900-c105-4619-80b6-651a199df01d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3e63980-b5f3-4754-822c-600487409609","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54444","PortSpecifier":{"PortValue":54444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b3e63980-b5f3-4754-822c-600487409609","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b3e63980-b5f3-4754-822c-600487409609","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54444","PortSpecifier":{"PortValue":54444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":799020279},"http":{"id":"b3e63980-b5f3-4754-822c-600487409609","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b3e63980-b5f3-4754-822c-600487409609","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"253238ab-2d98-48de-8df6-2de7ac011d25","keyName":"e2e-oidc-39f73d48","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"253238ab-2d98-48de-8df6-2de7ac011d25","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b3e63980-b5f3-4754-822c-600487409609","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b3e63980-b5f3-4754-822c-600487409609","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3e63980-b5f3-4754-822c-600487409609","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b3e63980-b5f3-4754-822c-600487409609","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84e295db-a0cb-44a0-acfe-35b5a345b159","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":807108427},"http":{"id":"84e295db-a0cb-44a0-acfe-35b5a345b159","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"253238ab-2d98-48de-8df6-2de7ac011d25","keyName":"e2e-oidc-39f73d48","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"253238ab-2d98-48de-8df6-2de7ac011d25","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-SfmImWfCJGoZ47Fi_oOzPmZAJXXA6GfrRvamC91LTa9Mozj8hOl3E1SGzXAa","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.35","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"84e295db-a0cb-44a0-acfe-35b5a345b159"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"84e295db-a0cb-44a0-acfe-35b5a345b159","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":807108427,"seconds":1783014009},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.35:53926","port":53926}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"253238ab-2d98-48de-8df6-2de7ac011d25","keyName":"e2e-oidc-39f73d48","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84e295db-a0cb-44a0-acfe-35b5a345b159","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54456","PortSpecifier":{"PortValue":54456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54456","PortSpecifier":{"PortValue":54456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":907529216},"http":{"id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:74483976-e1ba-7f2d-bf64-5b436a682140","preferred_username":"alice_lead","scope":"email profile","sid":"Gm5rwZX29w1y8tFzz-q8ms-l","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014069,"groups":["Engineering","Project-Alpha"],"iat":1783014009,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:74483976-e1ba-7f2d-bf64-5b436a682140","preferred_username":"alice_lead","scope":"email profile","sid":"Gm5rwZX29w1y8tFzz-q8ms-l","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"474f371c-d0b9-4e83-8d65-9ec97dbd7f88","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54462","PortSpecifier":{"PortValue":54462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54462","PortSpecifier":{"PortValue":54462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":938363533},"http":{"id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"dac17806-b6ed-44da-b71d-8e33759d0198","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3775b98a-0cd1-4a39-917d-d9389df7dd2c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b72b807c-459a-4a4f-ba90-6da4c120b581","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":946307237},"http":{"id":"b72b807c-459a-4a4f-ba90-6da4c120b581","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"dac17806-b6ed-44da-b71d-8e33759d0198","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.35","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b72b807c-459a-4a4f-ba90-6da4c120b581"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b72b807c-459a-4a4f-ba90-6da4c120b581","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":946307237,"seconds":1783014009},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.35:53926","port":53926}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b72b807c-459a-4a4f-ba90-6da4c120b581","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54478","PortSpecifier":{"PortValue":54478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54478","PortSpecifier":{"PortValue":54478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":978572710},"http":{"id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","method":"GET","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"dac17806-b6ed-44da-b71d-8e33759d0198","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7eafad49-93ac-4a7e-a620-6e794ec8411a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bd36291-9b15-473a-9223-36274397b395","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9bd36291-9b15-473a-9223-36274397b395","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bd36291-9b15-473a-9223-36274397b395","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.35:53926","PortSpecifier":{"PortValue":53926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014009,"nanos":985553743},"http":{"id":"9bd36291-9b15-473a-9223-36274397b395","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9bd36291-9b15-473a-9223-36274397b395","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"dac17806-b6ed-44da-b71d-8e33759d0198","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9bd36291-9b15-473a-9223-36274397b395","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9bd36291-9b15-473a-9223-36274397b395","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1RE0TBCjmo2INHTQa_HuMaOwazepshRMziRwnzpi6kO54xrmjidULyDEIqHdP","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.134.0.35","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctNjJkN3MKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.33~maas-default-gateway-openshift-default-56654dcf7-62d7s.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.134.0.35","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9bd36291-9b15-473a-9223-36274397b395"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9bd36291-9b15-473a-9223-36274397b395","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":985553743,"seconds":1783014009},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.134.0.35:53926","port":53926}}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bd36291-9b15-473a-9223-36274397b395","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"dac17806-b6ed-44da-b71d-8e33759d0198","keyName":"e2e-oidc-118bca91","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bd36291-9b15-473a-9223-36274397b395","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bd36291-9b15-473a-9223-36274397b395","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54480","PortSpecifier":{"PortValue":54480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a642c50d-046e-43f0-b134-3990384b1fa6","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.11:54480","PortSpecifier":{"PortValue":54480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.33:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783014010,"nanos":83963920},"http":{"id":"a642c50d-046e-43f0-b134-3990384b1fa6","method":"POST","headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014070,"groups":["Engineering","Project-Alpha"],"iat":1783014010,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:70d0c24f-380a-4c7f-91bc-8fb32ba4b2de","preferred_username":"alice_lead","scope":"email profile","sid":"bTqB1djWf_34n5RKRkNtayT4","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783014070,"groups":["Engineering","Project-Alpha"],"iat":1783014010,"iss":"https://keycloak.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:70d0c24f-380a-4c7f-91bc-8fb32ba4b2de","preferred_username":"alice_lead","scope":"email profile","sid":"bTqB1djWf_34n5RKRkNtayT4","sub":"a78e4509-ee45-43a4-9d52-0ddf9c5dd171","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.33:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.d4c11045-ce30-491e-8332-b016758bdda0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T17:40:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a642c50d-046e-43f0-b134-3990384b1fa6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T17:40:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6345a33b7509a9267727c47dd8e8d3f4ab7974b91909c17a49e75a184863d092"}
{"level":"info","ts":"2026-07-02T17:40:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b87ae20be634e7941a82681131b84d2144485c86ddbf9a8d229325d7b1c9c657"}
{"level":"info","ts":"2026-07-02T17:40:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dda0fffe0e9844459121fff00307415c1bacf5fadfde9732208445b2ade76dd2"}
{"level":"info","ts":"2026-07-02T17:40:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9f7f9d291df231647be013b0579b4c8e75611da1bac524d6975c2b3f4c748e8d"}