{"level":"debug","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:51:37Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:51:37Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/717af9f9fa566e3b44da1ccfe02cb116f6dc7915291dd3e8f6d6fccd1f5d4e2f"}
{"level":"info","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fbcc2249f1c755060810d15cab1e31dff6c21ce808b8869b59766913faf3103b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"af003d4b6f3c8acc7ec472e2d7d3dca61c84bfc8b579c293210f4193522b02f0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5c11bcde828f0d1af0886a8fc83c00bca883d2ccb74db86dc196281516e3100d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5e612c5104a9c7b2e35f8ca21f2fb885466c2fa4ace607b45f704fad19c93947","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1d426978d43f5c227ce126cd37ad15c0f659c1af4c02c6051079106534b6b3ac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"30be8ed5e3cc9377eaf9ad02fd81864b1ebf0ac586e160492206f47324168255","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c7dc81077136f20c3e148ac0f7ad08790d3f5622c82583aab93f94ebf79e1d4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5cfb8cc37a1c149af120c1dc0b2111325860de596728fece3d0c0d3aa14edea2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"717af9f9fa566e3b44da1ccfe02cb116f6dc7915291dd3e8f6d6fccd1f5d4e2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:51:37Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:51:37Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:51:38Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"}
{"level":"error","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:50698","PortSpecifier":{"PortValue":50698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:50698","PortSpecifier":{"PortValue":50698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915498,"nanos":888674279},"http":{"id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","method":"POST","headers":{":authority":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"]}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"153f733a486bbc220d0f54ef54d8e1e51a3962dc1323e6b598f75b19c4df0274"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.76:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-13c2c7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e985f3-dbda-4697-a21a-af41be48bb3f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53480","PortSpecifier":{"PortValue":53480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b9a122.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:53480","PortSpecifier":{"PortValue":53480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915498,"nanos":930709707},"http":{"id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","method":"POST","headers":{":authority":"e2e-shared-b-b9a122.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"]}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5e612c5104a9c7b2e35f8ca21f2fb885466c2fa4ace607b45f704fad19c93947"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b9a122.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b9a122/rate-test-model-b9a122\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-b9a122/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c6fbc39-fba6-4185-b3f7-2c70c0fa8923","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:50712","PortSpecifier":{"PortValue":50712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","method":"POST","path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions","host":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:50712","PortSpecifier":{"PortValue":50712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915498,"nanos":975026213},"http":{"id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","method":"POST","headers":{":authority":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1BwVumiTVq61gvPTD_xvxOmBseIrfeKk5AduE6eEcklAYgvhskaizeiBYn2Oz"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1BwVumiTVq61gvPTD_xvxOmBseIrfeKk5AduE6eEcklAYgvhskaizeiBYn2Oz\"}"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"759a8d8d-3ee6-4a95-b466-77cce01ba529","keyName":"e2e-rate-a-e4d437","subscription":"e2e-rate-iso-a-e4d437","tenant":"e2e-shared-a-13c2c7","userId":"759a8d8d-3ee6-4a95-b466-77cce01ba529","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\",\"requestedSubscription\":\"e2e-rate-iso-a-e4d437\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e4d437","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-13c2c7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:51:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e4d437"}
{"level":"debug","ts":"2026-07-24T17:51:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"759a8d8d-3ee6-4a95-b466-77cce01ba529","keyName":"e2e-rate-a-e4d437","selected_subscription":"e2e-rate-iso-a-e4d437","selected_subscription_key":"ai-tenant-e2e-shared-a-13c2c7/e2e-rate-iso-a-e4d437@ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e4d437","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:51:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:51:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b01b6f6-8263-4183-bac4-9ecfa022888f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57010","PortSpecifier":{"PortValue":57010}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","method":"POST","path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions","host":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57010","PortSpecifier":{"PortValue":57010}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915500,"nanos":58163646},"http":{"id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","method":"POST","headers":{":authority":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1BwVumiTVq61gvPTD_xvxOmBseIrfeKk5AduE6eEcklAYgvhskaizeiBYn2Oz"}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1BwVumiTVq61gvPTD_xvxOmBseIrfeKk5AduE6eEcklAYgvhskaizeiBYn2Oz\"}"}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"759a8d8d-3ee6-4a95-b466-77cce01ba529","keyName":"e2e-rate-a-e4d437","subscription":"e2e-rate-iso-a-e4d437","tenant":"e2e-shared-a-13c2c7","userId":"759a8d8d-3ee6-4a95-b466-77cce01ba529","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\",\"requestedSubscription\":\"e2e-rate-iso-a-e4d437\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e4d437","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"}}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-13c2c7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e4d437"}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"759a8d8d-3ee6-4a95-b466-77cce01ba529","keyName":"e2e-rate-a-e4d437","selected_subscription":"e2e-rate-iso-a-e4d437","selected_subscription_key":"ai-tenant-e2e-shared-a-13c2c7/e2e-rate-iso-a-e4d437@ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e4d437","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:51:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e9f1a33-d37e-4954-a459-3933f01f49a8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57022","PortSpecifier":{"PortValue":57022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30ca59ee-4b74-423a-97fb-37104f121c1a","method":"POST","path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions","host":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:57022","PortSpecifier":{"PortValue":57022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915501,"nanos":97431800},"http":{"id":"30ca59ee-4b74-423a-97fb-37104f121c1a","method":"POST","headers":{":authority":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1BwVumiTVq61gvPTD_xvxOmBseIrfeKk5AduE6eEcklAYgvhskaizeiBYn2Oz"}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1BwVumiTVq61gvPTD_xvxOmBseIrfeKk5AduE6eEcklAYgvhskaizeiBYn2Oz\"}"}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"759a8d8d-3ee6-4a95-b466-77cce01ba529","keyName":"e2e-rate-a-e4d437","subscription":"e2e-rate-iso-a-e4d437","tenant":"e2e-shared-a-13c2c7","userId":"759a8d8d-3ee6-4a95-b466-77cce01ba529","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\",\"requestedSubscription\":\"e2e-rate-iso-a-e4d437\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e4d437","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"}}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-13c2c7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e4d437"}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"759a8d8d-3ee6-4a95-b466-77cce01ba529","keyName":"e2e-rate-a-e4d437","selected_subscription":"e2e-rate-iso-a-e4d437","selected_subscription_key":"ai-tenant-e2e-shared-a-13c2c7/e2e-rate-iso-a-e4d437@ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e4d437","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:51:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30ca59ee-4b74-423a-97fb-37104f121c1a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48584","PortSpecifier":{"PortValue":48584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"afc15a2c-6d10-427e-802b-27b19c45cd14","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48584","PortSpecifier":{"PortValue":48584}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915518,"nanos":445776318},"http":{"id":"afc15a2c-6d10-427e-802b-27b19c45cd14","method":"POST","headers":{":authority":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"]}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"153f733a486bbc220d0f54ef54d8e1e51a3962dc1323e6b598f75b19c4df0274"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.76:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-13c2c7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"afc15a2c-6d10-427e-802b-27b19c45cd14","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35334","PortSpecifier":{"PortValue":35334}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b9a122.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35334","PortSpecifier":{"PortValue":35334}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915518,"nanos":488259213},"http":{"id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","method":"POST","headers":{":authority":"e2e-shared-b-b9a122.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"]}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5e612c5104a9c7b2e35f8ca21f2fb885466c2fa4ace607b45f704fad19c93947"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.49:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b9a122.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b9a122/rate-test-model-b9a122\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-b9a122/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b05ab3e-194e-4adf-9715-a3b59fa1c007","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48586","PortSpecifier":{"PortValue":48586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","method":"POST","path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions","host":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:48586","PortSpecifier":{"PortValue":48586}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915518,"nanos":524313940},"http":{"id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","method":"POST","headers":{":authority":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Q7dVJcV5A9Nsy6A3_JvimgzsJl9drTpj4DToNpW8eMVqOU2iW5I5ARlk5f9c"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Q7dVJcV5A9Nsy6A3_JvimgzsJl9drTpj4DToNpW8eMVqOU2iW5I5ARlk5f9c\"}"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"89a85cb9-3a93-4764-8d29-1546c135bb09","keyName":"e2e-rate-a-6dc3d1","subscription":"e2e-rate-iso-a-6dc3d1","tenant":"e2e-shared-a-13c2c7","userId":"89a85cb9-3a93-4764-8d29-1546c135bb09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\",\"requestedSubscription\":\"e2e-rate-iso-a-6dc3d1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6dc3d1","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-13c2c7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6dc3d1"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"89a85cb9-3a93-4764-8d29-1546c135bb09","keyName":"e2e-rate-a-6dc3d1","selected_subscription":"e2e-rate-iso-a-6dc3d1","selected_subscription_key":"ai-tenant-e2e-shared-a-13c2c7/e2e-rate-iso-a-6dc3d1@ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6dc3d1","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:51:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"92c5ccf9-1408-44ce-a00a-d12b6e9db6bc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47840","PortSpecifier":{"PortValue":47840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","method":"POST","path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions","host":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47840","PortSpecifier":{"PortValue":47840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915519,"nanos":567539169},"http":{"id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","method":"POST","headers":{":authority":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Q7dVJcV5A9Nsy6A3_JvimgzsJl9drTpj4DToNpW8eMVqOU2iW5I5ARlk5f9c"}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Q7dVJcV5A9Nsy6A3_JvimgzsJl9drTpj4DToNpW8eMVqOU2iW5I5ARlk5f9c\"}"}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"89a85cb9-3a93-4764-8d29-1546c135bb09","keyName":"e2e-rate-a-6dc3d1","subscription":"e2e-rate-iso-a-6dc3d1","tenant":"e2e-shared-a-13c2c7","userId":"89a85cb9-3a93-4764-8d29-1546c135bb09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\",\"requestedSubscription\":\"e2e-rate-iso-a-6dc3d1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6dc3d1","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"}}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-13c2c7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6dc3d1"}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"89a85cb9-3a93-4764-8d29-1546c135bb09","keyName":"e2e-rate-a-6dc3d1","selected_subscription":"e2e-rate-iso-a-6dc3d1","selected_subscription_key":"ai-tenant-e2e-shared-a-13c2c7/e2e-rate-iso-a-6dc3d1@ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6dc3d1","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:51:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f25ae011-53e6-4cd2-a8b4-da4cd5fd7a45","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47842","PortSpecifier":{"PortValue":47842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1903d376-e04a-4e31-a57e-98eaa6602413","method":"POST","path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions","host":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47842","PortSpecifier":{"PortValue":47842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.76:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915520,"nanos":609677230},"http":{"id":"1903d376-e04a-4e31-a57e-98eaa6602413","method":"POST","headers":{":authority":"e2e-shared-a-13c2c7.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Q7dVJcV5A9Nsy6A3_JvimgzsJl9drTpj4DToNpW8eMVqOU2iW5I5ARlk5f9c"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Q7dVJcV5A9Nsy6A3_JvimgzsJl9drTpj4DToNpW8eMVqOU2iW5I5ARlk5f9c\"}"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"89a85cb9-3a93-4764-8d29-1546c135bb09","keyName":"e2e-rate-a-6dc3d1","subscription":"e2e-rate-iso-a-6dc3d1","tenant":"e2e-shared-a-13c2c7","userId":"89a85cb9-3a93-4764-8d29-1546c135bb09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\",\"requestedSubscription\":\"e2e-rate-iso-a-6dc3d1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-13c2c7.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6dc3d1","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-13c2c7/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6dc3d1"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"89a85cb9-3a93-4764-8d29-1546c135bb09","keyName":"e2e-rate-a-6dc3d1","selected_subscription":"e2e-rate-iso-a-6dc3d1","selected_subscription_key":"ai-tenant-e2e-shared-a-13c2c7/e2e-rate-iso-a-6dc3d1@ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-13c2c7","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6dc3d1","namespace":"ai-tenant-e2e-shared-a-13c2c7","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-13c2c7/rate-test-model-13c2c7"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1903d376-e04a-4e31-a57e-98eaa6602413","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35868","PortSpecifier":{"PortValue":35868}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","method":"POST","path":"/ai-tenant-e2e-shared-b-b9a122/rate-test-model-b9a122/v1/completions","host":"e2e-shared-b-b9a122.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35868","PortSpecifier":{"PortValue":35868}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.49:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915520,"nanos":647164302},"http":{"id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","method":"POST","headers":{":authority":"e2e-shared-b-b9a122.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-b9a122/rate-test-model-b9a122/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1WxiJ1N4flKjyRmlh_AOCyEaSteszucFaxWU6s8hPtcN5QrDIGmhSGfQQAqJF"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-b9a122.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1WxiJ1N4flKjyRmlh_AOCyEaSteszucFaxWU6s8hPtcN5QrDIGmhSGfQQAqJF\"}"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b9a122.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"706376a2-91b1-448a-90c6-f7436db074af","keyName":"e2e-rate-b-6dc3d1","subscription":"e2e-rate-iso-b-6dc3d1","tenant":"e2e-shared-b-b9a122","userId":"706376a2-91b1-448a-90c6-f7436db074af","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-b9a122.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-b9a122/rate-test-model-b9a122\",\"requestedSubscription\":\"e2e-rate-iso-b-6dc3d1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b9a122.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b9a122","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-6dc3d1","namespace":"ai-tenant-e2e-shared-b-b9a122","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-b9a122/rate-test-model-b9a122"}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b9a122/rate-test-model-b9a122\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-b9a122/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-6dc3d1"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"706376a2-91b1-448a-90c6-f7436db074af","keyName":"e2e-rate-b-6dc3d1","selected_subscription":"e2e-rate-iso-b-6dc3d1","selected_subscription_key":"ai-tenant-e2e-shared-b-b9a122/e2e-rate-iso-b-6dc3d1@ai-tenant-e2e-shared-b-b9a122/rate-test-model-b9a122","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b9a122","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-6dc3d1","namespace":"ai-tenant-e2e-shared-b-b9a122","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-b9a122/rate-test-model-b9a122"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:52:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b7124f3b-ac1d-4f44-b75f-a2bbb1d13321","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:52:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/70195873d4f1a9831211c6720e41ebf0568a9adb99b601ee711f44ec0b14eda3"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ea52831b5385980a660ddf32748c3c9e400a40ecedcf7271e0f6b479b9ad8ba"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/89b688a86e47c0c5e911effc0e28ebfb77b7d06fecfb70449e41897e7447d1ec"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5dd6f6b71a596171bb8f7c50a15e33552c48b46706d8a0e70ff56d7c014e4819"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/213958d20e37a8b2248ddf6d3c34e88d59c052bc9acce9334615ebd14b5d485a"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2c7dc81077136f20c3e148ac0f7ad08790d3f5622c82583aab93f94ebf79e1d4"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/717af9f9fa566e3b44da1ccfe02cb116f6dc7915291dd3e8f6d6fccd1f5d4e2f"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5c11bcde828f0d1af0886a8fc83c00bca883d2ccb74db86dc196281516e3100d"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/af003d4b6f3c8acc7ec472e2d7d3dca61c84bfc8b579c293210f4193522b02f0"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/153f733a486bbc220d0f54ef54d8e1e51a3962dc1323e6b598f75b19c4df0274"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c3c8853dfd9be90ad27cb6e486a1a70f6c4208de02ae73d00f4428f57398769a"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4a2bd247f91dd5b1fe2b80feb0c3801cf9546a8c79ba37cb170d3e3d0438aff0"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3406a53f6e30cc0d15c7adc290708906dc32c02502a31ba5f71bb03b88d4a9ec"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b73b30ca06cc7b844b344aedab97049b2df7bdf3a74b2472729f6a4a366c3323"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bbb0fd35328f2e1c9b7f30ff374d622056e8481be1dc70de60a810c96627fb0b"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/30be8ed5e3cc9377eaf9ad02fd81864b1ebf0ac586e160492206f47324168255"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eff5ac38e28988a01ed4d87d5e4c35e3a82ba0815fd11fb62cb94b6529d1c19b"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1d426978d43f5c227ce126cd37ad15c0f659c1af4c02c6051079106534b6b3ac"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5cfb8cc37a1c149af120c1dc0b2111325860de596728fece3d0c0d3aa14edea2"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a43554d0392c0a11ad17d78a3c03d2fd69c525674e4ee529e06dd0e413c6565a"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6b573a73a63b0944a194e74db86e9182201635a39e453afae5ebabd076e3472f"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fd7df16bccee8ee2e49c791e00b46e428c505551e6a0dd8fe1496207f2fe9db2"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5e612c5104a9c7b2e35f8ca21f2fb885466c2fa4ace607b45f704fad19c93947"}
{"level":"info","ts":"2026-07-24T17:52:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fbcc2249f1c755060810d15cab1e31dff6c21ce808b8869b59766913faf3103b"}
{"level":"info","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54992","PortSpecifier":{"PortValue":54992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54992","PortSpecifier":{"PortValue":54992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915584,"nanos":264372138},"http":{"id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","method":"POST","headers":{":authority":"maas.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"]}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.50:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"406e09ba-4b74-4642-bb13-aabf0f48ec21","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:55008","PortSpecifier":{"PortValue":55008}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:55008","PortSpecifier":{"PortValue":55008}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.50:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915584,"nanos":322924840},"http":{"id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","method":"POST","headers":{":authority":"maas.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-7NFw17fGMmI0Xwh0_F9v82dvFNGd8KIhCEQrak2KxOkvrafg21StU0jEqdWF"}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-7NFw17fGMmI0Xwh0_F9v82dvFNGd8KIhCEQrak2KxOkvrafg21StU0jEqdWF\"}"}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e41a1c2d-e693-4126-94fd-298f318c2a5c","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"e41a1c2d-e693-4126-94fd-298f318c2a5c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.50:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e41a1c2d-e693-4126-94fd-298f318c2a5c","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:53:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0eef7426-d0ae-4bc5-8001-39a10ac6ed40","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"}
{"level":"error","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4"}
{"level":"info","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"57212b9f31cdf3190fa98ff775360241d35d95a31426932c467060dc35b0bce4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"57212b9f31cdf3190fa98ff775360241d35d95a31426932c467060dc35b0bce4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"57212b9f31cdf3190fa98ff775360241d35d95a31426932c467060dc35b0bce4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/57212b9f31cdf3190fa98ff775360241d35d95a31426932c467060dc35b0bce4"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"57212b9f31cdf3190fa98ff775360241d35d95a31426932c467060dc35b0bce4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"57212b9f31cdf3190fa98ff775360241d35d95a31426932c467060dc35b0bce4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T17:53:43Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["57212b9f31cdf3190fa98ff775360241d35d95a31426932c467060dc35b0bce4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"57212b9f31cdf3190fa98ff775360241d35d95a31426932c467060dc35b0bce4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"57212b9f31cdf3190fa98ff775360241d35d95a31426932c467060dc35b0bce4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb"}
{"level":"info","ts":"2026-07-24T17:53:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/57212b9f31cdf3190fa98ff775360241d35d95a31426932c467060dc35b0bce4"}
{"level":"info","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43854","PortSpecifier":{"PortValue":43854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-92693f.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43854","PortSpecifier":{"PortValue":43854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915629,"nanos":309473570},"http":{"id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","method":"POST","headers":{":authority":"e2e-ipp-a-92693f.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"]}}
{"level":"debug","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7e6548fc16a4"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=48dcb88b-b02f-4802-9a97-f881426aca98"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"7787eb5c-38f5-4b20-ba90-2dabc19dcf5a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-92693f.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-92693f/ipp-route-92693f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-92693f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:53:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c1aaa71-c821-484e-91ff-f23cd46d74ab","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43870","PortSpecifier":{"PortValue":43870}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","method":"POST","path":"/ai-tenant-e2e-ipp-a-92693f/ipp-route-92693f/v1/chat/completions","host":"e2e-ipp-a-92693f.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:43870","PortSpecifier":{"PortValue":43870}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784915631,"nanos":378030012},"http":{"id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","method":"POST","headers":{":authority":"e2e-ipp-a-92693f.apps.3477253e-65f3-4dc3-be1e-7e6548fc16a4.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-92693f/ipp-route-92693f/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vml5gwl3xzOziL3d_ntbVRRQwWznPcXxdgVM2M0gFUf4XGJH8knPAJZqA2nA"}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-92693f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vml5gwl3xzOziL3d_ntbVRRQwWznPcXxdgVM2M0gFUf4XGJH8knPAJZqA2nA\"}"}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-92693f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0bceef32-8e3f-4770-86f5-ee62f26b0042","keyName":"e2e-ipp-92693f","subscription":"ipp-route-92693f-sub","tenant":"e2e-ipp-a-92693f","userId":"0bceef32-8e3f-4770-86f5-ee62f26b0042","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-92693f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-92693f/ipp-route-92693f\",\"requestedSubscription\":\"ipp-route-92693f-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-92693f.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"ipp-route-92693f","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-92693f-sub","namespace":"ai-tenant-e2e-ipp-a-92693f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-92693f/ipp-route-92693f"}}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-92693f/ipp-route-92693f\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-92693f/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-92693f-sub"}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0bceef32-8e3f-4770-86f5-ee62f26b0042","keyName":"e2e-ipp-92693f","selected_subscription":"ipp-route-92693f-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-92693f/ipp-route-92693f-sub@ai-tenant-e2e-ipp-a-92693f/ipp-route-92693f","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"ipp-route-92693f","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-92693f-sub","namespace":"ai-tenant-e2e-ipp-a-92693f","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-92693f/ipp-route-92693f"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T17:53:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a987d06c-f32a-47a3-b58b-3b6c3e899e80","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b906adacc384b65af56cdc546320970483e296afd0beef306771e75e68e2143d"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a45668f2edc7e602fa70d90f7ebe043479f37db9bd2882cad8cc941b4bdb1710"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/29dc5c65a8fbed980e6c7a5a2bf8b358f5acdfc0f1a9275044eaa49e6e4b3fc6"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0c32f3eb290749dbf933bc56d383f758200d4cbe8c2363d4ebc9c7d489057619"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07a3e8ad3a7c77ea3616307a65d76efd7ed1f9fc3ddad7c07ae184ce1eaf0816"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ce13847dae218714d3b2d0aa3d59acbef20ff984016eef66a9cc00ef78d6cd42"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df9c0e086e6e5bf454e72a27d8da74ba7eb875c31e84eed58c80962f7ff740fa"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8ce0bc732333a662de6f56c51495639108c762707d113bf95703a9e10acbbf9b"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/adc39c23d41e4d6ad0d10bf74c1750931cc1e4401f01f77f42b2cf1e3e8e7aeb"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/57212b9f31cdf3190fa98ff775360241d35d95a31426932c467060dc35b0bce4"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f102a68e7667d2f987e4b7170c905c3c31595b7bbffac34a6aa1d511c63eccc6"}
{"level":"info","ts":"2026-07-24T17:54:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/395a8b8ec88b9dbfc24278d868eca0de712b640eaeeb69afeed00d9b3f526ac4"}