{"level":"debug","ts":"2026-07-22T01:16:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"33b7d175daddd8818515bf1136d21cb3ee42c57d564a0c1516d01982d171555f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["33b7d175daddd8818515bf1136d21cb3ee42c57d564a0c1516d01982d171555f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b"}
{"level":"info","ts":"2026-07-22T01:16:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"33b7d175daddd8818515bf1136d21cb3ee42c57d564a0c1516d01982d171555f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07bcf741da3c539b8e60d96c61556fdc2844dabe09a8fead6c74415c78145be2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39098f2a3d3d954bafd6aef3767d48c319f81b3e442b6911c66f57446e836e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:27Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39098f2a3d3d954bafd6aef3767d48c319f81b3e442b6911c66f57446e836e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07bcf741da3c539b8e60d96c61556fdc2844dabe09a8fead6c74415c78145be2"}
{"level":"info","ts":"2026-07-22T01:16:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"33b7d175daddd8818515bf1136d21cb3ee42c57d564a0c1516d01982d171555f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07bcf741da3c539b8e60d96c61556fdc2844dabe09a8fead6c74415c78145be2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:27Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:27Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07bcf741da3c539b8e60d96c61556fdc2844dabe09a8fead6c74415c78145be2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07bcf741da3c539b8e60d96c61556fdc2844dabe09a8fead6c74415c78145be2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39098f2a3d3d954bafd6aef3767d48c319f81b3e442b6911c66f57446e836e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:27Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:27Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39098f2a3d3d954bafd6aef3767d48c319f81b3e442b6911c66f57446e836e7c"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39098f2a3d3d954bafd6aef3767d48c319f81b3e442b6911c66f57446e836e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07bcf741da3c539b8e60d96c61556fdc2844dabe09a8fead6c74415c78145be2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39098f2a3d3d954bafd6aef3767d48c319f81b3e442b6911c66f57446e836e7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["39098f2a3d3d954bafd6aef3767d48c319f81b3e442b6911c66f57446e836e7c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39098f2a3d3d954bafd6aef3767d48c319f81b3e442b6911c66f57446e836e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39098f2a3d3d954bafd6aef3767d48c319f81b3e442b6911c66f57446e836e7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/33b7d175daddd8818515bf1136d21cb3ee42c57d564a0c1516d01982d171555f"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07bcf741da3c539b8e60d96c61556fdc2844dabe09a8fead6c74415c78145be2"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39098f2a3d3d954bafd6aef3767d48c319f81b3e442b6911c66f57446e836e7c"}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b"}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1"}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917"}
{"level":"error","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"611de6cd1e2917a20eb3ce01b690b74cffeddbeddaedc82f4f3e7d43cc953365","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/611de6cd1e2917a20eb3ce01b690b74cffeddbeddaedc82f4f3e7d43cc953365"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"611de6cd1e2917a20eb3ce01b690b74cffeddbeddaedc82f4f3e7d43cc953365","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/849058b1122b765532ef1fd90e79f8cc6537f0998841ce4c62e8c7e47734fbc7"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/611de6cd1e2917a20eb3ce01b690b74cffeddbeddaedc82f4f3e7d43cc953365"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"849058b1122b765532ef1fd90e79f8cc6537f0998841ce4c62e8c7e47734fbc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["849058b1122b765532ef1fd90e79f8cc6537f0998841ce4c62e8c7e47734fbc7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a6b682aad451cb3c3f35e7a512aa8b596eabce55539e94319934c00f08f9d22"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8cd58070ff630e3648861d909a5380bbe32b38e35db47e37beb2c5ac4b37677"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90b935b0324e42cf84fed06c97999d908fd08276d1ba2220653a224230a44fe3"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"849058b1122b765532ef1fd90e79f8cc6537f0998841ce4c62e8c7e47734fbc7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"611de6cd1e2917a20eb3ce01b690b74cffeddbeddaedc82f4f3e7d43cc953365","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["611de6cd1e2917a20eb3ce01b690b74cffeddbeddaedc82f4f3e7d43cc953365"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02586b341fd1dc27b56c348a88eef6397ad0dafa3dcf5de5666f4ca32bc2f242"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"611de6cd1e2917a20eb3ce01b690b74cffeddbeddaedc82f4f3e7d43cc953365","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6a6b682aad451cb3c3f35e7a512aa8b596eabce55539e94319934c00f08f9d22","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6a6b682aad451cb3c3f35e7a512aa8b596eabce55539e94319934c00f08f9d22"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7fa197dd7e94f3a36dafe677eb2e62d3a990ce4312234bd136426d08f893b33"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/849058b1122b765532ef1fd90e79f8cc6537f0998841ce4c62e8c7e47734fbc7"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6a6b682aad451cb3c3f35e7a512aa8b596eabce55539e94319934c00f08f9d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8cd58070ff630e3648861d909a5380bbe32b38e35db47e37beb2c5ac4b37677","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a8cd58070ff630e3648861d909a5380bbe32b38e35db47e37beb2c5ac4b37677"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/430986672dcea6bf5fdf784d89bab56ea0ef3ed2135c7223df5ff112f3348fd4"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ba5bec853ea2a775bd7cdf691c1ad8c5d0e5d18e78663bbdad150e285c03e116"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8003da5412749f99f8d9569a0f6529c4cdd1c1ecec9d453e91d933fdd0b0a18d"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8cd58070ff630e3648861d909a5380bbe32b38e35db47e37beb2c5ac4b37677","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90b935b0324e42cf84fed06c97999d908fd08276d1ba2220653a224230a44fe3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["90b935b0324e42cf84fed06c97999d908fd08276d1ba2220653a224230a44fe3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/611de6cd1e2917a20eb3ce01b690b74cffeddbeddaedc82f4f3e7d43cc953365"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a7348d58171ce14ed4b09013402f95fa63b046da7cdc4e0937bf8d8f6bfc1c1"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90b935b0324e42cf84fed06c97999d908fd08276d1ba2220653a224230a44fe3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"02586b341fd1dc27b56c348a88eef6397ad0dafa3dcf5de5666f4ca32bc2f242","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["02586b341fd1dc27b56c348a88eef6397ad0dafa3dcf5de5666f4ca32bc2f242"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6a6b682aad451cb3c3f35e7a512aa8b596eabce55539e94319934c00f08f9d22"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8cd58070ff630e3648861d909a5380bbe32b38e35db47e37beb2c5ac4b37677"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"02586b341fd1dc27b56c348a88eef6397ad0dafa3dcf5de5666f4ca32bc2f242","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a7fa197dd7e94f3a36dafe677eb2e62d3a990ce4312234bd136426d08f893b33","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a7fa197dd7e94f3a36dafe677eb2e62d3a990ce4312234bd136426d08f893b33"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90b935b0324e42cf84fed06c97999d908fd08276d1ba2220653a224230a44fe3"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/02586b341fd1dc27b56c348a88eef6397ad0dafa3dcf5de5666f4ca32bc2f242"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a7fa197dd7e94f3a36dafe677eb2e62d3a990ce4312234bd136426d08f893b33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"849058b1122b765532ef1fd90e79f8cc6537f0998841ce4c62e8c7e47734fbc7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"430986672dcea6bf5fdf784d89bab56ea0ef3ed2135c7223df5ff112f3348fd4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["430986672dcea6bf5fdf784d89bab56ea0ef3ed2135c7223df5ff112f3348fd4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7fa197dd7e94f3a36dafe677eb2e62d3a990ce4312234bd136426d08f893b33"}
{"level":"info","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"430986672dcea6bf5fdf784d89bab56ea0ef3ed2135c7223df5ff112f3348fd4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ba5bec853ea2a775bd7cdf691c1ad8c5d0e5d18e78663bbdad150e285c03e116","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:28Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ba5bec853ea2a775bd7cdf691c1ad8c5d0e5d18e78663bbdad150e285c03e116"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/430986672dcea6bf5fdf784d89bab56ea0ef3ed2135c7223df5ff112f3348fd4"}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ba5bec853ea2a775bd7cdf691c1ad8c5d0e5d18e78663bbdad150e285c03e116","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8003da5412749f99f8d9569a0f6529c4cdd1c1ecec9d453e91d933fdd0b0a18d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8003da5412749f99f8d9569a0f6529c4cdd1c1ecec9d453e91d933fdd0b0a18d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ba5bec853ea2a775bd7cdf691c1ad8c5d0e5d18e78663bbdad150e285c03e116"}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8003da5412749f99f8d9569a0f6529c4cdd1c1ecec9d453e91d933fdd0b0a18d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"611de6cd1e2917a20eb3ce01b690b74cffeddbeddaedc82f4f3e7d43cc953365","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a7348d58171ce14ed4b09013402f95fa63b046da7cdc4e0937bf8d8f6bfc1c1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a7348d58171ce14ed4b09013402f95fa63b046da7cdc4e0937bf8d8f6bfc1c1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8003da5412749f99f8d9569a0f6529c4cdd1c1ecec9d453e91d933fdd0b0a18d"}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a7348d58171ce14ed4b09013402f95fa63b046da7cdc4e0937bf8d8f6bfc1c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a7348d58171ce14ed4b09013402f95fa63b046da7cdc4e0937bf8d8f6bfc1c1"}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6a6b682aad451cb3c3f35e7a512aa8b596eabce55539e94319934c00f08f9d22","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8cd58070ff630e3648861d909a5380bbe32b38e35db47e37beb2c5ac4b37677","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90b935b0324e42cf84fed06c97999d908fd08276d1ba2220653a224230a44fe3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"02586b341fd1dc27b56c348a88eef6397ad0dafa3dcf5de5666f4ca32bc2f242","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7fa197dd7e94f3a36dafe677eb2e62d3a990ce4312234bd136426d08f893b33","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"430986672dcea6bf5fdf784d89bab56ea0ef3ed2135c7223df5ff112f3348fd4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ba5bec853ea2a775bd7cdf691c1ad8c5d0e5d18e78663bbdad150e285c03e116","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8003da5412749f99f8d9569a0f6529c4cdd1c1ecec9d453e91d933fdd0b0a18d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a7348d58171ce14ed4b09013402f95fa63b046da7cdc4e0937bf8d8f6bfc1c1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f"}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f"}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T01:16:29Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f"}
{"level":"error","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T01:16:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51786","PortSpecifier":{"PortValue":51786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51786","PortSpecifier":{"PortValue":51786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784682990,"nanos":982254382},"http":{"id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ce4734ca-86a3-4f8a-8af7-4c1295370965","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=28098aec-f89f-4dbd-b07c-60ecc00dfad8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d49c1e62296f"]}}
{"level":"debug","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d49c1e62296f"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=28098aec-f89f-4dbd-b07c-60ecc00dfad8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ce4734ca-86a3-4f8a-8af7-4c1295370965","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5699d1e6-7d69-4bbb-9b20-97241bd31df8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:36234","PortSpecifier":{"PortValue":36234}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-4f35c1.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:36234","PortSpecifier":{"PortValue":36234}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784682991,"nanos":20833167},"http":{"id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","method":"POST","headers":{":authority":"e2e-shared-b-4f35c1.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ce4734ca-86a3-4f8a-8af7-4c1295370965","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=28098aec-f89f-4dbd-b07c-60ecc00dfad8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d49c1e62296f"]}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d49c1e62296f"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=28098aec-f89f-4dbd-b07c-60ecc00dfad8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ce4734ca-86a3-4f8a-8af7-4c1295370965","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8003da5412749f99f8d9569a0f6529c4cdd1c1ecec9d453e91d933fdd0b0a18d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-4f35c1.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-4f35c1/rate-test-model-4f35c1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-4f35c1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eb9c14fc-90f2-460b-9f5b-b13c835731b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51802","PortSpecifier":{"PortValue":51802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51802","PortSpecifier":{"PortValue":51802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784682991,"nanos":58445150},"http":{"id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1b8FtzvsREDlzda7x_q32kU1owXK1eUfI6SsXG6LAMAYIIy3wSVQr2Rw0fjLN"}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1b8FtzvsREDlzda7x_q32kU1owXK1eUfI6SsXG6LAMAYIIy3wSVQr2Rw0fjLN\"}"}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9637036f-4b6d-457f-a071-d1f0a4188e32","keyName":"e2e-rate-a-5ca9b2","subscription":"e2e-rate-iso-a-5ca9b2","tenant":"e2e-shared-a-e4b9ac","userId":"9637036f-4b6d-457f-a071-d1f0a4188e32","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-5ca9b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ca9b2","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5ca9b2"}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9637036f-4b6d-457f-a071-d1f0a4188e32","keyName":"e2e-rate-a-5ca9b2","selected_subscription":"e2e-rate-iso-a-5ca9b2","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-5ca9b2@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ca9b2","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ac4f98f5-a4d2-4807-8141-36ac69c9416f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51818","PortSpecifier":{"PortValue":51818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"280bae60-71ed-418d-be2e-9c791dcf1d14","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51818","PortSpecifier":{"PortValue":51818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784682992,"nanos":133735212},"http":{"id":"280bae60-71ed-418d-be2e-9c791dcf1d14","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1b8FtzvsREDlzda7x_q32kU1owXK1eUfI6SsXG6LAMAYIIy3wSVQr2Rw0fjLN"}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1b8FtzvsREDlzda7x_q32kU1owXK1eUfI6SsXG6LAMAYIIy3wSVQr2Rw0fjLN\"}"}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9637036f-4b6d-457f-a071-d1f0a4188e32","keyName":"e2e-rate-a-5ca9b2","subscription":"e2e-rate-iso-a-5ca9b2","tenant":"e2e-shared-a-e4b9ac","userId":"9637036f-4b6d-457f-a071-d1f0a4188e32","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-5ca9b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ca9b2","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5ca9b2"}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9637036f-4b6d-457f-a071-d1f0a4188e32","keyName":"e2e-rate-a-5ca9b2","selected_subscription":"e2e-rate-iso-a-5ca9b2","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-5ca9b2@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ca9b2","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"280bae60-71ed-418d-be2e-9c791dcf1d14","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"251f53bc-a14d-9977-a821-97755f756fb2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51824","PortSpecifier":{"PortValue":51824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"251f53bc-a14d-9977-a821-97755f756fb2","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"251f53bc-a14d-9977-a821-97755f756fb2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:51824","PortSpecifier":{"PortValue":51824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784682993,"nanos":171670283},"http":{"id":"251f53bc-a14d-9977-a821-97755f756fb2","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1b8FtzvsREDlzda7x_q32kU1owXK1eUfI6SsXG6LAMAYIIy3wSVQr2Rw0fjLN"}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1b8FtzvsREDlzda7x_q32kU1owXK1eUfI6SsXG6LAMAYIIy3wSVQr2Rw0fjLN\"}"}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"9637036f-4b6d-457f-a071-d1f0a4188e32","keyName":"e2e-rate-a-5ca9b2","subscription":"e2e-rate-iso-a-5ca9b2","tenant":"e2e-shared-a-e4b9ac","userId":"9637036f-4b6d-457f-a071-d1f0a4188e32","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-5ca9b2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ca9b2","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"251f53bc-a14d-9977-a821-97755f756fb2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-5ca9b2"}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"251f53bc-a14d-9977-a821-97755f756fb2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"9637036f-4b6d-457f-a071-d1f0a4188e32","keyName":"e2e-rate-a-5ca9b2","selected_subscription":"e2e-rate-iso-a-5ca9b2","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-5ca9b2@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-5ca9b2","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"251f53bc-a14d-9977-a821-97755f756fb2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"251f53bc-a14d-9977-a821-97755f756fb2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44710","PortSpecifier":{"PortValue":44710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44710","PortSpecifier":{"PortValue":44710}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683001,"nanos":886495462},"http":{"id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ce4734ca-86a3-4f8a-8af7-4c1295370965","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=28098aec-f89f-4dbd-b07c-60ecc00dfad8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d49c1e62296f"]}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d49c1e62296f"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=28098aec-f89f-4dbd-b07c-60ecc00dfad8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ce4734ca-86a3-4f8a-8af7-4c1295370965","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd5d9eb1-904c-4f78-bc77-ddc85d4cd6ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44c2b113-7b10-96bb-88b2-75e100189578","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59660","PortSpecifier":{"PortValue":59660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44c2b113-7b10-96bb-88b2-75e100189578","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-4f35c1.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44c2b113-7b10-96bb-88b2-75e100189578","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:59660","PortSpecifier":{"PortValue":59660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683001,"nanos":924503788},"http":{"id":"44c2b113-7b10-96bb-88b2-75e100189578","method":"POST","headers":{":authority":"e2e-shared-b-4f35c1.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"44c2b113-7b10-96bb-88b2-75e100189578","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44c2b113-7b10-96bb-88b2-75e100189578","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ce4734ca-86a3-4f8a-8af7-4c1295370965","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=28098aec-f89f-4dbd-b07c-60ecc00dfad8"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d49c1e62296f"]}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44c2b113-7b10-96bb-88b2-75e100189578","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/d49c1e62296f"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=28098aec-f89f-4dbd-b07c-60ecc00dfad8"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ce4734ca-86a3-4f8a-8af7-4c1295370965","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8003da5412749f99f8d9569a0f6529c4cdd1c1ecec9d453e91d933fdd0b0a18d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.42:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-4f35c1.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44c2b113-7b10-96bb-88b2-75e100189578","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44c2b113-7b10-96bb-88b2-75e100189578","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44c2b113-7b10-96bb-88b2-75e100189578","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-4f35c1/rate-test-model-4f35c1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-4f35c1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"44c2b113-7b10-96bb-88b2-75e100189578","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44c2b113-7b10-96bb-88b2-75e100189578","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44c2b113-7b10-96bb-88b2-75e100189578","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44c2b113-7b10-96bb-88b2-75e100189578","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44c2b113-7b10-96bb-88b2-75e100189578","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44722","PortSpecifier":{"PortValue":44722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44722","PortSpecifier":{"PortValue":44722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683001,"nanos":972145379},"http":{"id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj\"}"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","subscription":"e2e-rate-iso-a-8ca5fb","tenant":"e2e-shared-a-e4b9ac","userId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","selected_subscription":"e2e-rate-iso-a-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-8ca5fb@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82fbdfd2-055e-4ba1-a519-a7790ad7c1c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44736","PortSpecifier":{"PortValue":44736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44736","PortSpecifier":{"PortValue":44736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683003,"nanos":9098582},"http":{"id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj"}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj\"}"}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","subscription":"e2e-rate-iso-a-8ca5fb","tenant":"e2e-shared-a-e4b9ac","userId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","selected_subscription":"e2e-rate-iso-a-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-8ca5fb@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4f3866cf-b5ce-4430-9266-06fdb0681cf6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e06cc993-369b-41d2-b601-26ac0b246929","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44750","PortSpecifier":{"PortValue":44750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e06cc993-369b-41d2-b601-26ac0b246929","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e06cc993-369b-41d2-b601-26ac0b246929","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44750","PortSpecifier":{"PortValue":44750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683004,"nanos":44721011},"http":{"id":"e06cc993-369b-41d2-b601-26ac0b246929","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj"}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj\"}"}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","subscription":"e2e-rate-iso-a-8ca5fb","tenant":"e2e-shared-a-e4b9ac","userId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e06cc993-369b-41d2-b601-26ac0b246929","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e06cc993-369b-41d2-b601-26ac0b246929","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","selected_subscription":"e2e-rate-iso-a-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-8ca5fb@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e06cc993-369b-41d2-b601-26ac0b246929","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e06cc993-369b-41d2-b601-26ac0b246929","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44752","PortSpecifier":{"PortValue":44752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44752","PortSpecifier":{"PortValue":44752}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683005,"nanos":85117207},"http":{"id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj"}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj\"}"}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","subscription":"e2e-rate-iso-a-8ca5fb","tenant":"e2e-shared-a-e4b9ac","userId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","selected_subscription":"e2e-rate-iso-a-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-8ca5fb@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f0514cb-e59a-4ba8-8351-50e80e75b1e9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44760","PortSpecifier":{"PortValue":44760}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44760","PortSpecifier":{"PortValue":44760}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683006,"nanos":124532671},"http":{"id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj"}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj\"}"}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","subscription":"e2e-rate-iso-a-8ca5fb","tenant":"e2e-shared-a-e4b9ac","userId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","selected_subscription":"e2e-rate-iso-a-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-8ca5fb@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f3ac97f-1b0e-9a53-b5eb-1cbb6f4325ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44768","PortSpecifier":{"PortValue":44768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44768","PortSpecifier":{"PortValue":44768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683007,"nanos":163125085},"http":{"id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj"}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj\"}"}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","subscription":"e2e-rate-iso-a-8ca5fb","tenant":"e2e-shared-a-e4b9ac","userId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","selected_subscription":"e2e-rate-iso-a-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-8ca5fb@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d24d82f3-b69c-4acb-90bf-62d0fd1596e7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44784","PortSpecifier":{"PortValue":44784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44784","PortSpecifier":{"PortValue":44784}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683008,"nanos":201309371},"http":{"id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj"}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj\"}"}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","subscription":"e2e-rate-iso-a-8ca5fb","tenant":"e2e-shared-a-e4b9ac","userId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","selected_subscription":"e2e-rate-iso-a-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-8ca5fb@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8231e744-3ad6-4f40-92a5-24ac32374e1b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44786","PortSpecifier":{"PortValue":44786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44786","PortSpecifier":{"PortValue":44786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683009,"nanos":237274466},"http":{"id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj"}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj\"}"}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","subscription":"e2e-rate-iso-a-8ca5fb","tenant":"e2e-shared-a-e4b9ac","userId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","selected_subscription":"e2e-rate-iso-a-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-8ca5fb@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fb5d5f29-94f6-410b-963a-b41b03bff93c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44798","PortSpecifier":{"PortValue":44798}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:44798","PortSpecifier":{"PortValue":44798}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683010,"nanos":284957588},"http":{"id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj"}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj\"}"}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","subscription":"e2e-rate-iso-a-8ca5fb","tenant":"e2e-shared-a-e4b9ac","userId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","selected_subscription":"e2e-rate-iso-a-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-8ca5fb@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"479ad5c8-4d2c-407c-a4ec-f134a8d82623","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5796880e-971f-4511-84a2-790a20b9a10e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39676","PortSpecifier":{"PortValue":39676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5796880e-971f-4511-84a2-790a20b9a10e","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5796880e-971f-4511-84a2-790a20b9a10e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39676","PortSpecifier":{"PortValue":39676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683011,"nanos":324300423},"http":{"id":"5796880e-971f-4511-84a2-790a20b9a10e","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj"}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj\"}"}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","subscription":"e2e-rate-iso-a-8ca5fb","tenant":"e2e-shared-a-e4b9ac","userId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5796880e-971f-4511-84a2-790a20b9a10e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5796880e-971f-4511-84a2-790a20b9a10e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","selected_subscription":"e2e-rate-iso-a-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-8ca5fb@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5796880e-971f-4511-84a2-790a20b9a10e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5796880e-971f-4511-84a2-790a20b9a10e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39684","PortSpecifier":{"PortValue":39684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"27cb485b-a65d-4450-b24a-c255b48a5074","method":"POST","path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions","host":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:39684","PortSpecifier":{"PortValue":39684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683012,"nanos":360578617},"http":{"id":"27cb485b-a65d-4450-b24a-c255b48a5074","method":"POST","headers":{":authority":"e2e-shared-a-e4b9ac.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yCQuWnsu2XDBaIyR_bUn3hOPZMPa09kmuxdbHzZEsjtQdQHqgyDputlaXDDj\"}"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","subscription":"e2e-rate-iso-a-8ca5fb","tenant":"e2e-shared-a-e4b9ac","userId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\",\"requestedSubscription\":\"e2e-rate-iso-a-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-e4b9ac.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-e4b9ac/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0ebe5ab2-e0bd-40b5-89b4-01e08977c30f","keyName":"e2e-rate-a-8ca5fb","selected_subscription":"e2e-rate-iso-a-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-a-e4b9ac/e2e-rate-iso-a-8ca5fb@ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-e4b9ac","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-8ca5fb","namespace":"ai-tenant-e2e-shared-a-e4b9ac","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-e4b9ac/rate-test-model-e4b9ac"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27cb485b-a65d-4450-b24a-c255b48a5074","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:37396","PortSpecifier":{"PortValue":37396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","method":"POST","path":"/ai-tenant-e2e-shared-b-4f35c1/rate-test-model-4f35c1/v1/completions","host":"e2e-shared-b-4f35c1.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:37396","PortSpecifier":{"PortValue":37396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.42:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784683012,"nanos":399729412},"http":{"id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","method":"POST","headers":{":authority":"e2e-shared-b-4f35c1.apps.eed271f0-7ad7-4dde-b586-d49c1e62296f.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-4f35c1/rate-test-model-4f35c1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-f2zBtVY4blVv7uP4_hOagxHOhLTuFqN4QlU6jyX2oyEEfso4nmnUizcilvB7"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-4f35c1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-f2zBtVY4blVv7uP4_hOagxHOhLTuFqN4QlU6jyX2oyEEfso4nmnUizcilvB7\"}"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-4f35c1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"21793084-db12-4d64-a279-0f02347daf4b","keyName":"e2e-rate-b-8ca5fb","subscription":"e2e-rate-iso-b-8ca5fb","tenant":"e2e-shared-b-4f35c1","userId":"21793084-db12-4d64-a279-0f02347daf4b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-4f35c1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-4f35c1/rate-test-model-4f35c1\",\"requestedSubscription\":\"e2e-rate-iso-b-8ca5fb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-4f35c1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-4f35c1","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-8ca5fb","namespace":"ai-tenant-e2e-shared-b-4f35c1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-4f35c1/rate-test-model-4f35c1"}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-4f35c1/rate-test-model-4f35c1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-4f35c1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-8ca5fb"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"21793084-db12-4d64-a279-0f02347daf4b","keyName":"e2e-rate-b-8ca5fb","selected_subscription":"e2e-rate-iso-b-8ca5fb","selected_subscription_key":"ai-tenant-e2e-shared-b-4f35c1/e2e-rate-iso-b-8ca5fb@ai-tenant-e2e-shared-b-4f35c1/rate-test-model-4f35c1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-4f35c1","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-8ca5fb","namespace":"ai-tenant-e2e-shared-b-4f35c1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-4f35c1/rate-test-model-4f35c1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T01:16:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d1aff609-ea11-4a41-a157-f9f6dcc71f77","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T01:16:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a7fa197dd7e94f3a36dafe677eb2e62d3a990ce4312234bd136426d08f893b33"}
{"level":"info","ts":"2026-07-22T01:16:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1a7348d58171ce14ed4b09013402f95fa63b046da7cdc4e0937bf8d8f6bfc1c1"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/90b935b0324e42cf84fed06c97999d908fd08276d1ba2220653a224230a44fe3"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/849058b1122b765532ef1fd90e79f8cc6537f0998841ce4c62e8c7e47734fbc7"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1457d0b3810e01606b2778c1d063ebf8520989e9ebb779359f326a46413bae75"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3b3a42a8edd8e89de84fb71869764188005f190bde18f3483b0c652986fec917"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/611de6cd1e2917a20eb3ce01b690b74cffeddbeddaedc82f4f3e7d43cc953365"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/02586b341fd1dc27b56c348a88eef6397ad0dafa3dcf5de5666f4ca32bc2f242"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1b5a05fd7929ee84ece9d71280308622d28496244e77d7cad06134a7b4ea3c89"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/430986672dcea6bf5fdf784d89bab56ea0ef3ed2135c7223df5ff112f3348fd4"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1d0f26ca6c1eae7c8455c3a963136e840b1054d303c7a35a33580c49ea5ba58f"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/33b7d175daddd8818515bf1136d21cb3ee42c57d564a0c1516d01982d171555f"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07bcf741da3c539b8e60d96c61556fdc2844dabe09a8fead6c74415c78145be2"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8cd58070ff630e3648861d909a5380bbe32b38e35db47e37beb2c5ac4b37677"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/39098f2a3d3d954bafd6aef3767d48c319f81b3e442b6911c66f57446e836e7c"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/15eb244bcf158e871e72ad8d1736a1d458bcadfe3565b0f22564af96d3cf4c3b"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ba5bec853ea2a775bd7cdf691c1ad8c5d0e5d18e78663bbdad150e285c03e116"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8003da5412749f99f8d9569a0f6529c4cdd1c1ecec9d453e91d933fdd0b0a18d"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df4049954180c99e797cbc6710b1f029767bcff59b1b90aaa330e906297a5eaa"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/700d8ab580146d2aa14ceaed74ef037eb60c50d1e1c19dda3b2986a6230213a1"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/aea8e69162983afdeac5eea4695259b3827a059572d124de58adc7668a949df8"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fc21a3bfcd23c6bf8f427234c37f2fd0207a997453761845daa6c42e930d1b77"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6a6b682aad451cb3c3f35e7a512aa8b596eabce55539e94319934c00f08f9d22"}
{"level":"info","ts":"2026-07-22T01:16:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/283b807d631c1c30ddb2c13031e03f208553d000255b2dcdeab23d56fe77f721"}