{"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","subscription":"e2e-rate-iso-a-09ba2c","tenant":"e2e-shared-a-2542df","userId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"}} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":963845180,"seconds":1784917499}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":60764},"address":"10.132.0.13:60764"}}}}},"destination":{"address":"10.134.0.66:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5"},"headers":{":authority":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":963845180,"seconds":1784917499},"url_path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:60764","port":60764}}} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-2542df/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-09ba2c"} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","selected_subscription":"e2e-rate-iso-a-09ba2c","selected_subscription_key":"ai-tenant-e2e-shared-a-2542df/e2e-rate-iso-a-09ba2c@ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:24:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"574f3d9e-d5ea-4cd5-bb2d-414ae498184d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60774","PortSpecifier":{"PortValue":60774}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","object":"source:{address:{socket_address:{address:\"10.132.0.13:60774\" port_value:60774}}} destination:{address:{socket_address:{address:\"10.134.0.66:443\" port_value:443}}} request:{time:{seconds:1784917501 nanos:20755840} http:{id:\"ea1b6fcb-1456-4e08-9948-ce394b2b3013\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"66\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"ea1b6fcb-1456-4e08-9948-ce394b2b3013\"} path:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\" host:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8ZBq5fQ3vnlIExyE_pWtGACZRwKuNBbMtVUqeXZmQFtTadw0RpKcFL9JFV4G"} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","subscription":"e2e-rate-iso-a-09ba2c","tenant":"e2e-shared-a-2542df","userId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"}} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","input":{"auth":{"identity":"Bearer **** deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":20755840,"seconds":1784917501}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":60774},"address":"10.132.0.13:60774"}}}}},"destination":{"address":"10.134.0.66:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5"},"headers":{":authority":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":20755840,"seconds":1784917501},"url_path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:60774","port":60774}}} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-2542df/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-09ba2c"} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","selected_subscription":"e2e-rate-iso-a-09ba2c","selected_subscription_key":"ai-tenant-e2e-shared-a-2542df/e2e-rate-iso-a-09ba2c@ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:25:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea1b6fcb-1456-4e08-9948-ce394b2b3013","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"213b9f93-08d1-4b30-a599-68efc549a402","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60778","PortSpecifier":{"PortValue":60778}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"213b9f93-08d1-4b30-a599-68efc549a402","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"213b9f93-08d1-4b30-a599-68efc549a402","object":"source:{address:{socket_address:{address:\"10.132.0.13:60778\" port_value:60778}}} destination:{address:{socket_address:{address:\"10.134.0.66:443\" port_value:443}}} request:{time:{seconds:1784917502 nanos:62688229} http:{id:\"213b9f93-08d1-4b30-a599-68efc549a402\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"66\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"213b9f93-08d1-4b30-a599-68efc549a402\"} path:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\" host:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8ZBq5fQ3vnlIExyE_pWtGACZRwKuNBbMtVUqeXZmQFtTadw0RpKcFL9JFV4G"} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","subscription":"e2e-rate-iso-a-09ba2c","tenant":"e2e-shared-a-2542df","userId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"}} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"213b9f93-08d1-4b30-a599-68efc549a402","input":{"auth":{"identity":"Bearer **** deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"213b9f93-08d1-4b30-a599-68efc549a402"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"213b9f93-08d1-4b30-a599-68efc549a402","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":62688229,"seconds":1784917502}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":60778},"address":"10.132.0.13:60778"}}}}},"destination":{"address":"10.134.0.66:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5"},"headers":{":authority":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"213b9f93-08d1-4b30-a599-68efc549a402"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"213b9f93-08d1-4b30-a599-68efc549a402","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":62688229,"seconds":1784917502},"url_path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:60778","port":60778}}} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-2542df/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-09ba2c"} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"213b9f93-08d1-4b30-a599-68efc549a402","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","selected_subscription":"e2e-rate-iso-a-09ba2c","selected_subscription_key":"ai-tenant-e2e-shared-a-2542df/e2e-rate-iso-a-09ba2c@ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"213b9f93-08d1-4b30-a599-68efc549a402","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:25:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"213b9f93-08d1-4b30-a599-68efc549a402","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60554","PortSpecifier":{"PortValue":60554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","object":"source:{address:{socket_address:{address:\"10.132.0.13:60554\" port_value:60554}}} destination:{address:{socket_address:{address:\"10.134.0.66:443\" port_value:443}}} request:{time:{seconds:1784917503 nanos:116476653} http:{id:\"4ae61e06-a4a6-4242-b300-020d09de9b8e\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"66\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"4ae61e06-a4a6-4242-b300-020d09de9b8e\"} path:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\" host:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8ZBq5fQ3vnlIExyE_pWtGACZRwKuNBbMtVUqeXZmQFtTadw0RpKcFL9JFV4G"} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","subscription":"e2e-rate-iso-a-09ba2c","tenant":"e2e-shared-a-2542df","userId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"}} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"4ae61e06-a4a6-4242-b300-020d09de9b8e"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":116476653,"seconds":1784917503}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":60554},"address":"10.132.0.13:60554"}}}}},"destination":{"address":"10.134.0.66:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5"},"headers":{":authority":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"4ae61e06-a4a6-4242-b300-020d09de9b8e"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":116476653,"seconds":1784917503},"url_path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:60554","port":60554}}} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-2542df/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-09ba2c"} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","selected_subscription":"e2e-rate-iso-a-09ba2c","selected_subscription_key":"ai-tenant-e2e-shared-a-2542df/e2e-rate-iso-a-09ba2c@ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:25:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4ae61e06-a4a6-4242-b300-020d09de9b8e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60566","PortSpecifier":{"PortValue":60566}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5590b015-f775-4c66-9393-a957eb36ae8a","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","object":"source:{address:{socket_address:{address:\"10.132.0.13:60566\" port_value:60566}}} destination:{address:{socket_address:{address:\"10.134.0.66:443\" port_value:443}}} request:{time:{seconds:1784917504 nanos:164293810} http:{id:\"5590b015-f775-4c66-9393-a957eb36ae8a\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"66\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"5590b015-f775-4c66-9393-a957eb36ae8a\"} path:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\" host:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8ZBq5fQ3vnlIExyE_pWtGACZRwKuNBbMtVUqeXZmQFtTadw0RpKcFL9JFV4G"} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","subscription":"e2e-rate-iso-a-09ba2c","tenant":"e2e-shared-a-2542df","userId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"}} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"5590b015-f775-4c66-9393-a957eb36ae8a"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"5590b015-f775-4c66-9393-a957eb36ae8a","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":164293810,"seconds":1784917504}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":60566},"address":"10.132.0.13:60566"}}}}},"destination":{"address":"10.134.0.66:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5"},"headers":{":authority":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"5590b015-f775-4c66-9393-a957eb36ae8a"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"5590b015-f775-4c66-9393-a957eb36ae8a","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":164293810,"seconds":1784917504},"url_path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:60566","port":60566}}} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-2542df/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-09ba2c"} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","selected_subscription":"e2e-rate-iso-a-09ba2c","selected_subscription_key":"ai-tenant-e2e-shared-a-2542df/e2e-rate-iso-a-09ba2c@ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:25:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5590b015-f775-4c66-9393-a957eb36ae8a","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60582","PortSpecifier":{"PortValue":60582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","object":"source:{address:{socket_address:{address:\"10.132.0.13:60582\" port_value:60582}}} destination:{address:{socket_address:{address:\"10.134.0.66:443\" port_value:443}}} request:{time:{seconds:1784917505 nanos:206464102} http:{id:\"80dea192-21a7-42d0-a8f1-7ee7377ebf3c\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"66\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"80dea192-21a7-42d0-a8f1-7ee7377ebf3c\"} path:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\" host:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-8ZBq5fQ3vnlIExyE_pWtGACZRwKuNBbMtVUqeXZmQFtTadw0RpKcFL9JFV4G"} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","subscription":"e2e-rate-iso-a-09ba2c","tenant":"e2e-shared-a-2542df","userId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"}} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":206464102,"seconds":1784917505}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":60582},"address":"10.132.0.13:60582"}}}}},"destination":{"address":"10.134.0.66:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5"},"headers":{":authority":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":206464102,"seconds":1784917505},"url_path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:60582","port":60582}}} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-2542df/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-09ba2c"} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7de426c0-3e2f-4850-ab55-5c04cf78d307","keyName":"e2e-rate-a-09ba2c","selected_subscription":"e2e-rate-iso-a-09ba2c","selected_subscription_key":"ai-tenant-e2e-shared-a-2542df/e2e-rate-iso-a-09ba2c@ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-09ba2c","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:25:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"80dea192-21a7-42d0-a8f1-7ee7377ebf3c","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60592","PortSpecifier":{"PortValue":60592}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"42c51717-c4ac-465b-b758-d1e63914a6d8","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","object":"source:{address:{socket_address:{address:\"10.132.0.13:60592\" port_value:60592}}} destination:{address:{socket_address:{address:\"10.134.0.66:443\" port_value:443}}} request:{time:{seconds:1784917511 nanos:738048675} http:{id:\"42c51717-c4ac-465b-b758-d1e63914a6d8\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/maas-api/v1/api-keys\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"70\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"42c51717-c4ac-465b-b758-d1e63914a6d8\"} path:\"/maas-api/v1/api-keys\" host:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"39a86e8103a3a5a8a2e30f6f28e6643190d84f195bcff2482bfe749335d539fc\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7722a85076ed"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=86f95cc8-dcd9-4967-be1f-1b8596020263"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f8f0f556-474c-47d7-b1c1-a22e40d030f7","username":"system:serviceaccount:default:tester-regular-user"}}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7722a85076ed"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=86f95cc8-dcd9-4967-be1f-1b8596020263"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f8f0f556-474c-47d7-b1c1-a22e40d030f7","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"39a86e8103a3a5a8a2e30f6f28e6643190d84f195bcff2482bfe749335d539fc"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"70","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"42c51717-c4ac-465b-b758-d1e63914a6d8"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"42c51717-c4ac-465b-b758-d1e63914a6d8","method":"POST","path":"/maas-api/v1/api-keys","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":738048675,"seconds":1784917511}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":60592},"address":"10.132.0.13:60592"}}}}},"destination":{"address":"10.134.0.66:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"39a86e8103a3a5a8a2e30f6f28e6643190d84f195bcff2482bfe749335d539fc"},"headers":{":authority":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"70","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"42c51717-c4ac-465b-b758-d1e63914a6d8"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"42c51717-c4ac-465b-b758-d1e63914a6d8","method":"POST","path":"/maas-api/v1/api-keys","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":738048675,"seconds":1784917511},"url_path":"/maas-api/v1/api-keys","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:60592","port":60592}}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-2542df/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42c51717-c4ac-465b-b758-d1e63914a6d8","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:47012","PortSpecifier":{"PortValue":47012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","object":"source:{address:{socket_address:{address:\"10.132.0.13:47012\" port_value:47012}}} destination:{address:{socket_address:{address:\"10.134.0.67:443\" port_value:443}}} request:{time:{seconds:1784917511 nanos:786162245} http:{id:\"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/maas-api/v1/api-keys\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"70\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"maas-api-e2e-shared-b-f556c1.odh-ai-gateway-infra.svc.cluster.local:8443/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdC02ODU2NWQ3OTliLWRna2RqCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.134.0.67~e2e-shared-b-f556c1-openshift-default-68565d799b-dgkdj.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d\"} path:\"/maas-api/v1/api-keys\" host:\"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"77c082b9e0e86c9a404a261369e6a530fcb56767c3ced636cffb8a07950cc18e\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7722a85076ed"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=86f95cc8-dcd9-4967-be1f-1b8596020263"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f8f0f556-474c-47d7-b1c1-a22e40d030f7","username":"system:serviceaccount:default:tester-regular-user"}}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7722a85076ed"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=86f95cc8-dcd9-4967-be1f-1b8596020263"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f8f0f556-474c-47d7-b1c1-a22e40d030f7","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"77c082b9e0e86c9a404a261369e6a530fcb56767c3ced636cffb8a07950cc18e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.67:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"70","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api-e2e-shared-b-f556c1.odh-ai-gateway-infra.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdC02ODU2NWQ3OTliLWRna2RqCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.67~e2e-shared-b-f556c1-openshift-default-68565d799b-dgkdj.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d"},"host":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","method":"POST","path":"/maas-api/v1/api-keys","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":786162245,"seconds":1784917511}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":47012},"address":"10.132.0.13:47012"}}}}},"destination":{"address":"10.134.0.67:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"77c082b9e0e86c9a404a261369e6a530fcb56767c3ced636cffb8a07950cc18e"},"headers":{":authority":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"70","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api-e2e-shared-b-f556c1.odh-ai-gateway-infra.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdC02ODU2NWQ3OTliLWRna2RqCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.67~e2e-shared-b-f556c1-openshift-default-68565d799b-dgkdj.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d"},"host":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","method":"POST","path":"/maas-api/v1/api-keys","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":786162245,"seconds":1784917511},"url_path":"/maas-api/v1/api-keys","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:47012","port":47012}}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-f556c1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e5256a5-1c8b-4cf1-a3bf-8b091bdead2d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60608","PortSpecifier":{"PortValue":60608}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","object":"source:{address:{socket_address:{address:\"10.132.0.13:60608\" port_value:60608}}} destination:{address:{socket_address:{address:\"10.134.0.66:443\" port_value:443}}} request:{time:{seconds:1784917511 nanos:824585723} http:{id:\"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"66\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6\"} path:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\" host:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-jasK3VfNisbeskFA_OQhRUxRXuP4963WyujDQy7lMwcRfK6zl6KXVZVndhbH"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3d03b59b-2f9e-4deb-8957-bad5f3c05fd2","keyName":"e2e-rate-a-31e732","subscription":"e2e-rate-iso-a-31e732","tenant":"e2e-shared-a-2542df","userId":"3d03b59b-2f9e-4deb-8957-bad5f3c05fd2","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31e732","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":824585723,"seconds":1784917511}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":60608},"address":"10.132.0.13:60608"}}}}},"destination":{"address":"10.134.0.66:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5"},"headers":{":authority":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":824585723,"seconds":1784917511},"url_path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:60608","port":60608}}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-2542df/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31e732"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3d03b59b-2f9e-4deb-8957-bad5f3c05fd2","keyName":"e2e-rate-a-31e732","selected_subscription":"e2e-rate-iso-a-31e732","selected_subscription_key":"ai-tenant-e2e-shared-a-2542df/e2e-rate-iso-a-31e732@ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31e732","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:25:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2bc783ac-4504-4ff9-bb9a-6e9fdc4480b6","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34744","PortSpecifier":{"PortValue":34744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","object":"source:{address:{socket_address:{address:\"10.132.0.13:34744\" port_value:34744}}} destination:{address:{socket_address:{address:\"10.134.0.66:443\" port_value:443}}} request:{time:{seconds:1784917512 nanos:864725636} http:{id:\"a1a45205-aab1-4019-ae8d-2e2981e9fb34\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"66\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"a1a45205-aab1-4019-ae8d-2e2981e9fb34\"} path:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\" host:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-jasK3VfNisbeskFA_OQhRUxRXuP4963WyujDQy7lMwcRfK6zl6KXVZVndhbH"} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3d03b59b-2f9e-4deb-8957-bad5f3c05fd2","keyName":"e2e-rate-a-31e732","subscription":"e2e-rate-iso-a-31e732","tenant":"e2e-shared-a-2542df","userId":"3d03b59b-2f9e-4deb-8957-bad5f3c05fd2","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31e732","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"}} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","input":{"auth":{"identity":"Bearer **** deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":864725636,"seconds":1784917512}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":34744},"address":"10.132.0.13:34744"}}}}},"destination":{"address":"10.134.0.66:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5"},"headers":{":authority":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":864725636,"seconds":1784917512},"url_path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:34744","port":34744}}} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-2542df/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31e732"} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3d03b59b-2f9e-4deb-8957-bad5f3c05fd2","keyName":"e2e-rate-a-31e732","selected_subscription":"e2e-rate-iso-a-31e732","selected_subscription_key":"ai-tenant-e2e-shared-a-2542df/e2e-rate-iso-a-31e732@ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31e732","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:25:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1a45205-aab1-4019-ae8d-2e2981e9fb34","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:34758","PortSpecifier":{"PortValue":34758}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","object":"source:{address:{socket_address:{address:\"10.132.0.13:34758\" port_value:34758}}} destination:{address:{socket_address:{address:\"10.134.0.66:443\" port_value:443}}} request:{time:{seconds:1784917513 nanos:906892625} http:{id:\"e3a880c3-44fa-4cf2-852c-7edcb05f9d36\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"66\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"e3a880c3-44fa-4cf2-852c-7edcb05f9d36\"} path:\"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions\" host:\"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-jasK3VfNisbeskFA_OQhRUxRXuP4963WyujDQy7lMwcRfK6zl6KXVZVndhbH"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3d03b59b-2f9e-4deb-8957-bad5f3c05fd2","keyName":"e2e-rate-a-31e732","subscription":"e2e-rate-iso-a-31e732","tenant":"e2e-shared-a-2542df","userId":"3d03b59b-2f9e-4deb-8957-bad5f3c05fd2","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2542df.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31e732","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","input":{"auth":{"identity":"Bearer **** deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":906892625,"seconds":1784917513}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":34758},"address":"10.132.0.13:34758"}}}}},"destination":{"address":"10.134.0.66:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5"},"headers":{":authority":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-2542df-kserve-workload-svc.ai-tenant-e2e-shared-a-2542df.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdC02Yjk2N2I2NzY0LWY1NTlyCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1hLTI1NDJkZi1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYS0yNTQyZGYtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.66~e2e-shared-a-2542df-openshift-default-6b967b6764-f559r.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36"},"host":"e2e-shared-a-2542df.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","method":"POST","path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":906892625,"seconds":1784917513},"url_path":"/ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df/v1/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:34758","port":34758}}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-2542df/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-31e732"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3d03b59b-2f9e-4deb-8957-bad5f3c05fd2","keyName":"e2e-rate-a-31e732","selected_subscription":"e2e-rate-iso-a-31e732","selected_subscription_key":"ai-tenant-e2e-shared-a-2542df/e2e-rate-iso-a-31e732@ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2542df","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-31e732","namespace":"ai-tenant-e2e-shared-a-2542df","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-2542df/rate-test-model-2542df"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3a880c3-44fa-4cf2-852c-7edcb05f9d36","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:51910","PortSpecifier":{"PortValue":51910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"edb701fd-de9b-4584-90b6-c9afa334b87b","method":"POST","path":"/ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1/v1/completions","host":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","object":"source:{address:{socket_address:{address:\"10.132.0.13:51910\" port_value:51910}}} destination:{address:{socket_address:{address:\"10.134.0.67:443\" port_value:443}}} request:{time:{seconds:1784917513 nanos:948215487} http:{id:\"edb701fd-de9b-4584-90b6-c9afa334b87b\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1/v1/completions\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"66\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"rate-test-model-f556c1-kserve-workload-svc.ai-tenant-e2e-shared-b-f556c1.svc.cluster.local:8000/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdC02ODU2NWQ3OTliLWRna2RqCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.134.0.67~e2e-shared-b-f556c1-openshift-default-68565d799b-dgkdj.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"edb701fd-de9b-4584-90b6-c9afa334b87b\"} path:\"/ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1/v1/completions\" host:\"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"0542e62501ae161c599b0d17787897ded7164ed87adfcb559a5ef4230a479353\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Y9vVM93cxyj2j5cm_SFVmSQY6AwFMx0PZ2EJbAYbcNu6RlZro454oJwNFp3l"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-f556c1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f556c1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d83f6671-d34d-47ca-a966-85f8b523bb6a","keyName":"e2e-rate-b-31e732","subscription":"e2e-rate-iso-b-31e732","tenant":"e2e-shared-b-f556c1","userId":"d83f6671-d34d-47ca-a966-85f8b523bb6a","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-f556c1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f556c1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-f556c1","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-31e732","namespace":"ai-tenant-e2e-shared-b-f556c1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1"}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-f556c1-kserve-workload-svc.ai-tenant-e2e-shared-b-f556c1.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdC02ODU2NWQ3OTliLWRna2RqCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.67~e2e-shared-b-f556c1-openshift-default-68565d799b-dgkdj.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"edb701fd-de9b-4584-90b6-c9afa334b87b"},"host":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"edb701fd-de9b-4584-90b6-c9afa334b87b","method":"POST","path":"/ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1/v1/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":948215487,"seconds":1784917513}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51910},"address":"10.132.0.13:51910"}}}}},"destination":{"address":"10.134.0.67:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"0542e62501ae161c599b0d17787897ded7164ed87adfcb559a5ef4230a479353"},"headers":{":authority":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"rate-test-model-f556c1-kserve-workload-svc.ai-tenant-e2e-shared-b-f556c1.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqJAQoGTEFCRUxTEn8qfQpKCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0CkAKBE5BTUUSOBo2ZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdC02ODU2NWQ3OTliLWRna2RqCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpzCgVPV05FUhJqGmhrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLXNoYXJlZC1iLWY1NTZjMS1vcGVuc2hpZnQtZGVmYXVsdAo4Cg1XT1JLTE9BRF9OQU1FEicaJWUyZS1zaGFyZWQtYi1mNTU2YzEtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.134.0.67~e2e-shared-b-f556c1-openshift-default-68565d799b-dgkdj.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"edb701fd-de9b-4584-90b6-c9afa334b87b"},"host":"e2e-shared-b-f556c1.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"edb701fd-de9b-4584-90b6-c9afa334b87b","method":"POST","path":"/ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1/v1/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":948215487,"seconds":1784917513},"url_path":"/ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1/v1/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:51910","port":51910}}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-f556c1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-31e732"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d83f6671-d34d-47ca-a966-85f8b523bb6a","keyName":"e2e-rate-b-31e732","selected_subscription":"e2e-rate-iso-b-31e732","selected_subscription_key":"ai-tenant-e2e-shared-b-f556c1/e2e-rate-iso-b-31e732@ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-f556c1","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-31e732","namespace":"ai-tenant-e2e-shared-b-f556c1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-f556c1/rate-test-model-f556c1"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:25:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"edb701fd-de9b-4584-90b6-c9afa334b87b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5f41ac9f45af4693a2937e28eb3a28ef68ad8172a860d5f298895c8ea9d2c1b1"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/556da300ee9d8db38abf43c571b2dd5a895041dc443f2e579d08e9051f03f277"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/84abf48a1fac3d5555c4eb08ff090a9d0ad55426c2ad625f7ed7428005e8445d"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/285a5eff6cfe44e3d80e743d394f824fc609cf4402fbe38a0415bf5f664cbb68"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e7fa6e5f1d5efa0fcd08c72358b5a14ad360ec023b2978d06e868141874c9de1"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2eb07abd832f95c61aca8da6caa86f165a47a759d59a0464fc1bae608b04b046"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7d3eb0c21320930642f261102c051e4e699cb91c6d3dd827de95fc3b73a7177e"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0542e62501ae161c599b0d17787897ded7164ed87adfcb559a5ef4230a479353"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5197460ff3caee6f19754d100a5b0ad350f71707a3fe5f8df7bc3378e2095fb5"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/617c21b50a3a697cda6e975394115e3c8c5e816618503f431de6669533c31c9f"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3c9671e319b2444ff8b6f2ca924aedd5d1d7766975342349298b955707401f45"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e64c244e727d65ae3d8d8ae253ad02cfa2ecb25ebc49ae6af8f8ea970583d431"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0f27d7cfc56ef211d2804ec0c43c6b8b51e289c441447ea29f0cbc27621d8718"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7ec07147371d77f0a51b225092aff13030e0bdbb2a947dafe80ec432351c9a4d"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0630373b6bb3f6cab5dad056a5de8482a57a602e993889d85fae17162f5e87de"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/39a86e8103a3a5a8a2e30f6f28e6643190d84f195bcff2482bfe749335d539fc"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/77c082b9e0e86c9a404a261369e6a530fcb56767c3ced636cffb8a07950cc18e"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/444473d690595ea62a6b92a06eb19b27a1feee3cb08d3eaf9ec92c3216b2e5d5"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/72cefceccaafbbe834df8892a254340532208fddd26dde0cb94bf4023ec89738"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/993b4865677e37b6b510e38323cc133f0cd7b98d2bc66b9924d8614027f6eb8f"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ba794c1f62267b5ed22ddc8381e9962f287c6533edb8a61cbcad56dd8352500"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/feab34305b20c26037f41c10051a4a400208ecb660662c7881308a0f4b3aa61e"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bf8577adb713bf6ae16023200d0de0b3fb317e89cfd28625d6270765071eea3a"} {"level":"info","ts":"2026-07-24T18:25:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/40767a1d727c9d58c08d58a244240b69f05e5a22e0088e3b049fa65e29006a3d"} {"level":"info","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50212","PortSpecifier":{"PortValue":50212}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b8caa826-df34-4c12-9924-2fbefe33694d","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","object":"source:{address:{socket_address:{address:\"10.132.0.13:50212\" port_value:50212}}} destination:{address:{socket_address:{address:\"10.132.0.29:443\" port_value:443}}} request:{time:{seconds:1784917578 nanos:25970463} http:{id:\"b8caa826-df34-4c12-9924-2fbefe33694d\" method:\"POST\" headers:{key:\":authority\" value:\"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/maas-api/v1/api-keys\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"69\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC03OGJiNzhmZjc4LXRsbnB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.132.0.29~maas-default-gateway-openshift-default-78bb78ff78-tlnpt.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"b8caa826-df34-4c12-9924-2fbefe33694d\"} path:\"/maas-api/v1/api-keys\" host:\"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7722a85076ed"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=86f95cc8-dcd9-4967-be1f-1b8596020263"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f8f0f556-474c-47d7-b1c1-a22e40d030f7","username":"system:serviceaccount:default:tester-regular-user"}}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7722a85076ed"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=86f95cc8-dcd9-4967-be1f-1b8596020263"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f8f0f556-474c-47d7-b1c1-a22e40d030f7","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"69","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC03OGJiNzhmZjc4LXRsbnB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.132.0.29~maas-default-gateway-openshift-default-78bb78ff78-tlnpt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"b8caa826-df34-4c12-9924-2fbefe33694d"},"host":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"b8caa826-df34-4c12-9924-2fbefe33694d","method":"POST","path":"/maas-api/v1/api-keys","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":25970463,"seconds":1784917578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":50212},"address":"10.132.0.13:50212"}}}}},"destination":{"address":"10.132.0.29:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"headers":{":authority":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"69","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC03OGJiNzhmZjc4LXRsbnB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.132.0.29~maas-default-gateway-openshift-default-78bb78ff78-tlnpt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"b8caa826-df34-4c12-9924-2fbefe33694d"},"host":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"b8caa826-df34-4c12-9924-2fbefe33694d","method":"POST","path":"/maas-api/v1/api-keys","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":25970463,"seconds":1784917578},"url_path":"/maas-api/v1/api-keys","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:50212","port":50212}}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b8caa826-df34-4c12-9924-2fbefe33694d","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:50216","PortSpecifier":{"PortValue":50216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.29:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","object":"source:{address:{socket_address:{address:\"10.132.0.13:50216\" port_value:50216}}} destination:{address:{socket_address:{address:\"10.132.0.29:443\" port_value:443}}} request:{time:{seconds:1784917578 nanos:90184801} http:{id:\"050d3e59-1c77-41e1-99ac-4d57652dbb0c\" method:\"POST\" headers:{key:\":authority\" value:\"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/llm/facebook-opt-125m-simulated/v1/chat/completions\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC03OGJiNzhmZjc4LXRsbnB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.132.0.29~maas-default-gateway-openshift-default-78bb78ff78-tlnpt.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-gateway-model-name\" value:\"facebook/opt-125m\"} headers:{key:\"x-request-id\" value:\"050d3e59-1c77-41e1-99ac-4d57652dbb0c\"} path:\"/llm/facebook-opt-125m-simulated/v1/chat/completions\" host:\"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1LtD2N933zOtIwWKp_MhHGWAlaQ61sMdpQGrk0udz0f5qCfUAxjZbNNvLrWOF"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"303f4bde-aacc-4e14-a3e0-2808876883f9","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"303f4bde-aacc-4e14-a3e0-2808876883f9","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.29:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC03OGJiNzhmZjc4LXRsbnB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.132.0.29~maas-default-gateway-openshift-default-78bb78ff78-tlnpt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-gateway-model-name":"facebook/opt-125m","x-request-id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c"},"host":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":90184801,"seconds":1784917578}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":50216},"address":"10.132.0.13:50216"}}}}},"destination":{"address":"10.132.0.29:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"headers":{":authority":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-type":"application/json","forwarded":"for=52.71.36.72;host=maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQQoETkFNRRI5GjdtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC03OGJiNzhmZjc4LXRsbnB0CiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwp0CgVPV05FUhJrGmlrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvbWFhcy1kZWZhdWx0LWdhdGV3YXktb3BlbnNoaWZ0LWRlZmF1bHQKOQoNV09SS0xPQURfTkFNRRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdA==","x-envoy-peer-metadata-id":"router~10.132.0.29~maas-default-gateway-openshift-default-78bb78ff78-tlnpt.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-gateway-model-name":"facebook/opt-125m","x-request-id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c"},"host":"maas.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":90184801,"seconds":1784917578},"url_path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:50216","port":50216}}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"303f4bde-aacc-4e14-a3e0-2808876883f9","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:26:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"050d3e59-1c77-41e1-99ac-4d57652dbb0c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"error","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e"} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314"} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644"} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644"} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5"} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5"} {"level":"error","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"} {"level":"error","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"error","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5"} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5"} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"error","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5"} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e79630c79fd1b920b2c6e3987299058872fa6488d22097045024a48351b4ba4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e79630c79fd1b920b2c6e3987299058872fa6488d22097045024a48351b4ba4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e79630c79fd1b920b2c6e3987299058872fa6488d22097045024a48351b4ba4"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e79630c79fd1b920b2c6e3987299058872fa6488d22097045024a48351b4ba4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1e79630c79fd1b920b2c6e3987299058872fa6488d22097045024a48351b4ba4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e79630c79fd1b920b2c6e3987299058872fa6488d22097045024a48351b4ba4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e79630c79fd1b920b2c6e3987299058872fa6488d22097045024a48351b4ba4"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e79630c79fd1b920b2c6e3987299058872fa6488d22097045024a48351b4ba4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e79630c79fd1b920b2c6e3987299058872fa6488d22097045024a48351b4ba4"} {"level":"error","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9"} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32"} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"640861b7a04dec721ff728c805b424208fd51a42e87a54f30ddb53f6a11d0e79","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/640861b7a04dec721ff728c805b424208fd51a42e87a54f30ddb53f6a11d0e79"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"640861b7a04dec721ff728c805b424208fd51a42e87a54f30ddb53f6a11d0e79","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"640861b7a04dec721ff728c805b424208fd51a42e87a54f30ddb53f6a11d0e79","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["640861b7a04dec721ff728c805b424208fd51a42e87a54f30ddb53f6a11d0e79"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"640861b7a04dec721ff728c805b424208fd51a42e87a54f30ddb53f6a11d0e79","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/640861b7a04dec721ff728c805b424208fd51a42e87a54f30ddb53f6a11d0e79"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/640861b7a04dec721ff728c805b424208fd51a42e87a54f30ddb53f6a11d0e79"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"640861b7a04dec721ff728c805b424208fd51a42e87a54f30ddb53f6a11d0e79","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220"} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T18:26:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220"} {"level":"error","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/cachi2/output/deps/gomod/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-24T18:26:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a720336d-0e58-4bf4-91cb-19987d540030","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53898","PortSpecifier":{"PortValue":53898}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a720336d-0e58-4bf4-91cb-19987d540030","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a720336d-0e58-4bf4-91cb-19987d540030","object":"source:{address:{socket_address:{address:\"10.132.0.13:53898\" port_value:53898}}} destination:{address:{socket_address:{address:\"10.132.0.56:443\" port_value:443}}} request:{time:{seconds:1784917612 nanos:683475912} http:{id:\"a720336d-0e58-4bf4-91cb-19987d540030\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/maas-api/v1/api-keys\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"66\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"maas-api-e2e-ipp-a-d91e94.odh-ai-gateway-infra.svc.cluster.local:8443/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqGAQoGTEFCRUxTEnwqegpHCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0Cj0KBE5BTUUSNRozZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdC01ZGQ4ZGZkY2Y0LTU3cXZoCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpwCgVPV05FUhJnGmVrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdAo1Cg1XT1JLTE9BRF9OQU1FEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.132.0.56~e2e-ipp-a-d91e94-openshift-default-5dd8dfdcf4-57qvh.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"a720336d-0e58-4bf4-91cb-19987d540030\"} path:\"/maas-api/v1/api-keys\" host:\"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a720336d-0e58-4bf4-91cb-19987d540030","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a720336d-0e58-4bf4-91cb-19987d540030","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7722a85076ed"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=86f95cc8-dcd9-4967-be1f-1b8596020263"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f8f0f556-474c-47d7-b1c1-a22e40d030f7","username":"system:serviceaccount:default:tester-regular-user"}}} {"level":"debug","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a720336d-0e58-4bf4-91cb-19987d540030","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/7722a85076ed"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=86f95cc8-dcd9-4967-be1f-1b8596020263"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f8f0f556-474c-47d7-b1c1-a22e40d030f7","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.56:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api-e2e-ipp-a-d91e94.odh-ai-gateway-infra.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqGAQoGTEFCRUxTEnwqegpHCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0Cj0KBE5BTUUSNRozZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdC01ZGQ4ZGZkY2Y0LTU3cXZoCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpwCgVPV05FUhJnGmVrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdAo1Cg1XT1JLTE9BRF9OQU1FEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.132.0.56~e2e-ipp-a-d91e94-openshift-default-5dd8dfdcf4-57qvh.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"a720336d-0e58-4bf4-91cb-19987d540030"},"host":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"a720336d-0e58-4bf4-91cb-19987d540030","method":"POST","path":"/maas-api/v1/api-keys","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":683475912,"seconds":1784917612}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":53898},"address":"10.132.0.13:53898"}}}}},"destination":{"address":"10.132.0.56:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314"},"headers":{":authority":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"66","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api-e2e-ipp-a-d91e94.odh-ai-gateway-infra.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqGAQoGTEFCRUxTEnwqegpHCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0Cj0KBE5BTUUSNRozZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdC01ZGQ4ZGZkY2Y0LTU3cXZoCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpwCgVPV05FUhJnGmVrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdAo1Cg1XT1JLTE9BRF9OQU1FEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.132.0.56~e2e-ipp-a-d91e94-openshift-default-5dd8dfdcf4-57qvh.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"a720336d-0e58-4bf4-91cb-19987d540030"},"host":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"a720336d-0e58-4bf4-91cb-19987d540030","method":"POST","path":"/maas-api/v1/api-keys","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":683475912,"seconds":1784917612},"url_path":"/maas-api/v1/api-keys","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:53898","port":53898}}} {"level":"debug","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a720336d-0e58-4bf4-91cb-19987d540030","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a720336d-0e58-4bf4-91cb-19987d540030","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a720336d-0e58-4bf4-91cb-19987d540030","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-d91e94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a720336d-0e58-4bf4-91cb-19987d540030","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a720336d-0e58-4bf4-91cb-19987d540030","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a720336d-0e58-4bf4-91cb-19987d540030","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a720336d-0e58-4bf4-91cb-19987d540030","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:26:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a720336d-0e58-4bf4-91cb-19987d540030","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:53914","PortSpecifier":{"PortValue":53914}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.56:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f37e2734-d182-4af8-8374-ad62e333cbb9","method":"POST","path":"/ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94/v1/chat/completions","host":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","object":"source:{address:{socket_address:{address:\"10.132.0.13:53914\" port_value:53914}}} destination:{address:{socket_address:{address:\"10.132.0.56:443\" port_value:443}}} request:{time:{seconds:1784917614 nanos:748568226} http:{id:\"f37e2734-d182-4af8-8374-ad62e333cbb9\" method:\"POST\" headers:{key:\":authority\" value:\"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\":method\" value:\"POST\"} headers:{key:\":path\" value:\"/ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94/v1/chat/completions\"} headers:{key:\":scheme\" value:\"https\"} headers:{key:\"accept\" value:\"*/*\"} headers:{key:\"accept-encoding\" value:\"gzip, deflate\"} headers:{key:\"authorization\" value:\"***REDACTED***\"} headers:{key:\"content-length\" value:\"110\"} headers:{key:\"content-type\" value:\"application/json\"} headers:{key:\"forwarded\" value:\"for=52.71.36.72;host=e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https\"} headers:{key:\"user-agent\" value:\"python-requests/2.32.5\"} headers:{key:\"x-envoy-decorator-operation\" value:\"ipp-route-d91e94-kserve-workload-svc.ai-tenant-e2e-ipp-a-d91e94.svc.cluster.local:8000/*\"} headers:{key:\"x-envoy-external-address\" value:\"10.132.0.13\"} headers:{key:\"x-envoy-peer-metadata\" value:\"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqGAQoGTEFCRUxTEnwqegpHCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0Cj0KBE5BTUUSNRozZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdC01ZGQ4ZGZkY2Y0LTU3cXZoCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpwCgVPV05FUhJnGmVrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdAo1Cg1XT1JLTE9BRF9OQU1FEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQ=\"} headers:{key:\"x-envoy-peer-metadata-id\" value:\"router~10.132.0.56~e2e-ipp-a-d91e94-openshift-default-5dd8dfdcf4-57qvh.openshift-ingress~openshift-ingress.svc.cluster.local\"} headers:{key:\"x-forwarded-for\" value:\"52.71.36.72,10.132.0.13\"} headers:{key:\"x-forwarded-host\" value:\"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\"} headers:{key:\"x-forwarded-port\" value:\"443\"} headers:{key:\"x-forwarded-proto\" value:\"https\"} headers:{key:\"x-request-id\" value:\"f37e2734-d182-4af8-8374-ad62e333cbb9\"} path:\"/ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94/v1/chat/completions\" host:\"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com\" scheme:\"https\" protocol:\"HTTP/1.1\"}} context_extensions:{key:\"host\" value:\"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e\"} metadata_context:{}"} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPHjF4VCDM3O8SNk_gMS6GrcQsq8Si179h7FSYIbhqTtNLs3ovp6t1pNawh9"} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-d91e94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-d91e94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cc56768c-f6a4-4100-9366-759344c5144a","keyName":"e2e-ipp-d91e94","subscription":"ipp-route-d91e94-sub","tenant":"e2e-ipp-a-d91e94","userId":"cc56768c-f6a4-4100-9366-759344c5144a","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-d91e94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"***REDACTED***"} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-d91e94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"ipp-route-d91e94","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-d91e94-sub","namespace":"ai-tenant-e2e-ipp-a-d91e94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94"}} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"***REDACTED***","content-length":"110","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"ipp-route-d91e94-kserve-workload-svc.ai-tenant-e2e-ipp-a-d91e94.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqGAQoGTEFCRUxTEnwqegpHCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0Cj0KBE5BTUUSNRozZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdC01ZGQ4ZGZkY2Y0LTU3cXZoCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpwCgVPV05FUhJnGmVrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdAo1Cg1XT1JLTE9BRF9OQU1FEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.132.0.56~e2e-ipp-a-d91e94-openshift-default-5dd8dfdcf4-57qvh.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"f37e2734-d182-4af8-8374-ad62e333cbb9"},"host":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"f37e2734-d182-4af8-8374-ad62e333cbb9","method":"POST","path":"/ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94/v1/chat/completions","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":748568226,"seconds":1784917614}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":53914},"address":"10.132.0.13:53914"}}}}},"destination":{"address":"10.132.0.56:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e"},"headers":{":authority":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"***REDACTED***","content-length":"110","content-type":"application/json","forwarded":"for=52.71.36.72;host=e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"ipp-route-d91e94-kserve-workload-svc.ai-tenant-e2e-ipp-a-d91e94.svc.cluster.local:8000/*","x-envoy-external-address":"10.132.0.13","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqGAQoGTEFCRUxTEnwqegpHCh9zZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1uYW1lEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQKLwojc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtcmV2aXNpb24SCBoGbGF0ZXN0Cj0KBE5BTUUSNRozZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdC01ZGQ4ZGZkY2Y0LTU3cXZoCiAKCU5BTUVTUEFDRRITGhFvcGVuc2hpZnQtaW5ncmVzcwpwCgVPV05FUhJnGmVrdWJlcm5ldGVzOi8vYXBpcy9hcHBzL3YxL25hbWVzcGFjZXMvb3BlbnNoaWZ0LWluZ3Jlc3MvZGVwbG95bWVudHMvZTJlLWlwcC1hLWQ5MWU5NC1vcGVuc2hpZnQtZGVmYXVsdAo1Cg1XT1JLTE9BRF9OQU1FEiQaImUyZS1pcHAtYS1kOTFlOTQtb3BlbnNoaWZ0LWRlZmF1bHQ=","x-envoy-peer-metadata-id":"router~10.132.0.56~e2e-ipp-a-d91e94-openshift-default-5dd8dfdcf4-57qvh.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.13","x-forwarded-host":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"f37e2734-d182-4af8-8374-ad62e333cbb9"},"host":"e2e-ipp-a-d91e94.apps.1934cc3c-2753-45f5-9fec-7722a85076ed.prod.konfluxeaas.com","id":"f37e2734-d182-4af8-8374-ad62e333cbb9","method":"POST","path":"/ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94/v1/chat/completions","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":748568226,"seconds":1784917614},"url_path":"/ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94/v1/chat/completions","user_agent":"python-requests/2.32.5"},"source":{"address":"10.132.0.13:53914","port":53914}}} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-d91e94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-d91e94-sub"} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cc56768c-f6a4-4100-9366-759344c5144a","keyName":"e2e-ipp-d91e94","selected_subscription":"ipp-route-d91e94-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94-sub@ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"ipp-route-d91e94","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-d91e94-sub","namespace":"ai-tenant-e2e-ipp-a-d91e94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-d91e94/ipp-route-d91e94"},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-24T18:26:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f37e2734-d182-4af8-8374-ad62e333cbb9","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-24T18:27:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c7b5f58c1009d1de3647368d23c44c90b120a8c1908b94d93fb153817e67d26a"} {"level":"info","ts":"2026-07-24T18:27:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a160a89c2016edf2909c194eded7d977ba2ce3026442cf85499aaa31a19d563e"} {"level":"info","ts":"2026-07-24T18:27:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7831677fd5e85ec71bca780621627a0ef990e96c35cad726b87f259ae13badf9"} {"level":"info","ts":"2026-07-24T18:27:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/967910d796e0114922e89631a5cd9370ccc5c86067ea204d007e8f13d570f8a5"} {"level":"info","ts":"2026-07-24T18:27:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4b9108ea58a19570585b4728c0769984ac0a8cb526327cd594d48cfb82d6600e"} {"level":"info","ts":"2026-07-24T18:27:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/27c56ad9d0e3cff430e6fc2b54d3b437b0692b8729444339d172cb695a246d32"} {"level":"info","ts":"2026-07-24T18:27:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5cb8e812b9195d993ea73ffe1f755f1e6fd9532a556d0ddf69992da608a32220"} {"level":"info","ts":"2026-07-24T18:27:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/640861b7a04dec721ff728c805b424208fd51a42e87a54f30ddb53f6a11d0e79"} {"level":"info","ts":"2026-07-24T18:27:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/32bf802e2c8311cc017989d5d89171e72e7bc5019761bfcfb2c0978ec5446644"} {"level":"info","ts":"2026-07-24T18:27:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/917e470c9129991bdd834349cee46ccd35aa08df77b94a2072231127e8a4b314"} {"level":"info","ts":"2026-07-24T18:27:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1e79630c79fd1b920b2c6e3987299058872fa6488d22097045024a48351b4ba4"} {"level":"info","ts":"2026-07-24T18:27:56Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5bebd641c32f18e3b2e1bb68c30e5d6e4354b5ff57f2d2d17d2451a305a02533"}