--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) --- {"level":"debug","ts":"2026-07-17T18:52:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:52:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:52:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:52:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d"} {"level":"info","ts":"2026-07-17T18:52:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:52:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:52:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:52:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d"} {"level":"debug","ts":"2026-07-17T18:52:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:52:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:52:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:52:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:52:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:52:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d"} {"level":"info","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53498","PortSpecifier":{"PortValue":53498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53498","PortSpecifier":{"PortValue":53498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314356,"nanos":89257055},"http":{"id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/auth-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68b8410e-d6bb-42d1-b2c5-d2d2b9733541","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39622","PortSpecifier":{"PortValue":39622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39622","PortSpecifier":{"PortValue":39622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314356,"nanos":148094446},"http":{"id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/auth-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"487ecc7e-e9ac-46e8-96d1-edfd4937ad27","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53504","PortSpecifier":{"PortValue":53504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","method":"GET","path":"/maas-api/v1/api-keys/197df872-4183-4199-a986-7fd7512d9288","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:53504","PortSpecifier":{"PortValue":53504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314356,"nanos":204242028},"http":{"id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","method":"GET","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/197df872-4183-4199-a986-7fd7512d9288",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/197df872-4183-4199-a986-7fd7512d9288",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/auth-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9d40df85-cf9c-4e5c-80d3-4ed7da90ed3c","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39638","PortSpecifier":{"PortValue":39638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","method":"GET","path":"/maas-api/v1/api-keys/e7766f9e-4c9c-4544-afba-35580a18d7f3","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:39638","PortSpecifier":{"PortValue":39638}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314356,"nanos":241796163},"http":{"id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","method":"GET","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/e7766f9e-4c9c-4544-afba-35580a18d7f3",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/e7766f9e-4c9c-4544-afba-35580a18d7f3",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/auth-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:52:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6194f4ec-4b6b-4ffb-9bd4-f44363014f2e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:56366","PortSpecifier":{"PortValue":56366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:56366","PortSpecifier":{"PortValue":56366}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314373,"nanos":431329721},"http":{"id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/auth-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d012d043-9d5a-4235-9a3d-a47bb9177e9b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57712","PortSpecifier":{"PortValue":57712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"01fb7d58-9500-4699-a37f-f12e051096b5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:57712","PortSpecifier":{"PortValue":57712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314373,"nanos":469423642},"http":{"id":"01fb7d58-9500-4699-a37f-f12e051096b5","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/auth-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"01fb7d58-9500-4699-a37f-f12e051096b5","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:56376","PortSpecifier":{"PortValue":56376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:56376","PortSpecifier":{"PortValue":56376}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314373,"nanos":513955740},"http":{"id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","method":"GET","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-RmECTJbYVnJy6MoZ_aFZ3zKMUm9DqqYySBv7chEiajkHNTFPTzJ160syIyqW"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-RmECTJbYVnJy6MoZ_aFZ3zKMUm9DqqYySBv7chEiajkHNTFPTzJ160syIyqW\"}"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ef75c912-01c7-4546-87b6-a56f81334868","keyName":"e2e-auth-iso-a-576896","subscription":"e2e-auth-iso-2394f4","tenant":"e2e-shared-a-7d6f90","userId":"ef75c912-01c7-4546-87b6-a56f81334868","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/auth-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-2394f4"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:52:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1c77576-0b0b-4a24-9fe7-c073daae3b66","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:45768","PortSpecifier":{"PortValue":45768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:45768","PortSpecifier":{"PortValue":45768}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314392,"nanos":816401708},"http":{"id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/auth-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1aa4e05b-bee7-45e3-b85b-6daf7466c31b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55426","PortSpecifier":{"PortValue":55426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55426","PortSpecifier":{"PortValue":55426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314392,"nanos":852184150},"http":{"id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/auth-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9697d8ed-ef70-4477-940a-69dc86d3cf95","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55432","PortSpecifier":{"PortValue":55432}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55432","PortSpecifier":{"PortValue":55432}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314392,"nanos":889042806},"http":{"id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","method":"GET","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-161oxg82R6EqaGQbS_dRgrT4OGr13gOnQlgM29RTLYrua3qtEIIZBP0mf0CBM"} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-161oxg82R6EqaGQbS_dRgrT4OGr13gOnQlgM29RTLYrua3qtEIIZBP0mf0CBM\"}"} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key not found","tenant":"","valid":false}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","input":{"auth":{"identity":"Bearer **** not found","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"} {"level":"info","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}} {"level":"debug","ts":"2026-07-17T18:53:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29607dcc-f1b1-46c7-aa35-f95eb3c15ad6","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}} {"level":"info","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48614","PortSpecifier":{"PortValue":48614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"47e2cfc5-161c-4172-980c-15114f6b0897","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48614","PortSpecifier":{"PortValue":48614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314412,"nanos":233791336},"http":{"id":"47e2cfc5-161c-4172-980c-15114f6b0897","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/auth-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47e2cfc5-161c-4172-980c-15114f6b0897","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48610","PortSpecifier":{"PortValue":48610}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48610","PortSpecifier":{"PortValue":48610}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314412,"nanos":270875894},"http":{"id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/auth-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bd53bd2-057e-480f-ab0e-1b1412b804c7","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48616","PortSpecifier":{"PortValue":48616}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48616","PortSpecifier":{"PortValue":48616}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314412,"nanos":308278085},"http":{"id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/auth-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7837cd1-4805-44bd-a5a1-74fc0fc851a4","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48618","PortSpecifier":{"PortValue":48618}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5a079d34-80fc-417f-8304-6a926c7d800f","method":"POST","path":"/maas-api/v1/api-keys/search","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:48618","PortSpecifier":{"PortValue":48618}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314412,"nanos":344326044},"http":{"id":"5a079d34-80fc-417f-8304-6a926c7d800f","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys/search",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/auth-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:53:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a079d34-80fc-417f-8304-6a926c7d800f","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36354","PortSpecifier":{"PortValue":36354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36354","PortSpecifier":{"PortValue":36354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314429,"nanos":538648775},"http":{"id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/auth-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9539c2b-1408-47e2-af17-7a1f6dc06ab7","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:47966","PortSpecifier":{"PortValue":47966}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:47966","PortSpecifier":{"PortValue":47966}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314429,"nanos":573933119},"http":{"id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/auth-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a44f07a5-4b1e-412d-a501-b949c9ab9c11","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"578c2889-2440-41ca-812c-855574001a12","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:47972","PortSpecifier":{"PortValue":47972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"578c2889-2440-41ca-812c-855574001a12","method":"GET","path":"/maas-api/v1/api-keys/6c016c2a-aa33-4036-aa2d-514d59787ba7","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"578c2889-2440-41ca-812c-855574001a12","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:47972","PortSpecifier":{"PortValue":47972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314429,"nanos":610969280},"http":{"id":"578c2889-2440-41ca-812c-855574001a12","method":"GET","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/6c016c2a-aa33-4036-aa2d-514d59787ba7",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"578c2889-2440-41ca-812c-855574001a12","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"578c2889-2440-41ca-812c-855574001a12","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"578c2889-2440-41ca-812c-855574001a12","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/6c016c2a-aa33-4036-aa2d-514d59787ba7",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"578c2889-2440-41ca-812c-855574001a12","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"578c2889-2440-41ca-812c-855574001a12","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"578c2889-2440-41ca-812c-855574001a12","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/auth-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"578c2889-2440-41ca-812c-855574001a12","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"578c2889-2440-41ca-812c-855574001a12","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"578c2889-2440-41ca-812c-855574001a12","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"578c2889-2440-41ca-812c-855574001a12","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"578c2889-2440-41ca-812c-855574001a12","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"00749f09-a6e0-407a-a019-ee4a43980421","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36356","PortSpecifier":{"PortValue":36356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"00749f09-a6e0-407a-a019-ee4a43980421","method":"GET","path":"/maas-api/v1/api-keys/6c016c2a-aa33-4036-aa2d-514d59787ba7","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"00749f09-a6e0-407a-a019-ee4a43980421","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36356","PortSpecifier":{"PortValue":36356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314429,"nanos":641412934},"http":{"id":"00749f09-a6e0-407a-a019-ee4a43980421","method":"GET","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/6c016c2a-aa33-4036-aa2d-514d59787ba7",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"00749f09-a6e0-407a-a019-ee4a43980421","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"00749f09-a6e0-407a-a019-ee4a43980421","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"00749f09-a6e0-407a-a019-ee4a43980421","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/6c016c2a-aa33-4036-aa2d-514d59787ba7",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00749f09-a6e0-407a-a019-ee4a43980421","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00749f09-a6e0-407a-a019-ee4a43980421","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"00749f09-a6e0-407a-a019-ee4a43980421","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/auth-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"00749f09-a6e0-407a-a019-ee4a43980421","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00749f09-a6e0-407a-a019-ee4a43980421","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"00749f09-a6e0-407a-a019-ee4a43980421","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"00749f09-a6e0-407a-a019-ee4a43980421","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:53:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"00749f09-a6e0-407a-a019-ee4a43980421","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40670","PortSpecifier":{"PortValue":40670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40670","PortSpecifier":{"PortValue":40670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314448,"nanos":943865978},"http":{"id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/auth-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c8c9ba4c-1db1-46b8-8b2d-1bd20805e831","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59276","PortSpecifier":{"PortValue":59276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:59276","PortSpecifier":{"PortValue":59276}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314448,"nanos":979755278},"http":{"id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/auth-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:54:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb052b0d-5252-47e3-961a-3f3accb1b52c","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40672","PortSpecifier":{"PortValue":40672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40672","PortSpecifier":{"PortValue":40672}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314449,"nanos":15802583},"http":{"id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1AYfciqBvJ1SkIRcW_c3BcGeJ8b28VVFEwqNXzsaETgfs5Am0Xw4vztCtnMrt"} {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1AYfciqBvJ1SkIRcW_c3BcGeJ8b28VVFEwqNXzsaETgfs5Am0Xw4vztCtnMrt\"}"} {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8cc6814d-239b-4d50-bfe0-563905bc9487","keyName":"e2e-auth-iso-a-d171f8","subscription":"e2e-auth-iso-72a78d","tenant":"e2e-shared-a-7d6f90","userId":"8cc6814d-239b-4d50-bfe0-563905bc9487","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/auth-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"} {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-72a78d"} {"level":"info","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:54:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c53b89c8-d48d-4958-b0bf-dd7e87a88430","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:54:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/adbca498198572a93d242313e71b51c3c746410a94b0930715e9612052211687"} {"level":"info","ts":"2026-07-17T18:54:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/caeb6278f8eed6b7b64853f879ff67eb1627bc05f7692a3d8f5687d3e7e3e4e1"} {"level":"info","ts":"2026-07-17T18:54:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8f4378d326adf34bcbe25d1d3ce6d4fa29bdc2d4c5b9d4f8e9b0a337b140db67"} {"level":"info","ts":"2026-07-17T18:54:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4112ce38c09956a61311dc0abbb699b2fd15757905a3b58caf3285af2a535f27"} {"level":"info","ts":"2026-07-17T18:54:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2736f672cebb912a9d3779cfab006372cf60ee6b8eac6a8847de71115dfaabd7"} {"level":"info","ts":"2026-07-17T18:54:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2eb5dbbef1a728aa377bf98186094dc9f93e3aa5e5253b89b05d569ae334624e"} {"level":"info","ts":"2026-07-17T18:54:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d86eb7286a5652e5f87f9caf45dac5d5dc997e7165a29462f7d4f4d49e86c21d"} {"level":"info","ts":"2026-07-17T18:54:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8d1938b2d0815a7f312462576619abb5f0fce5347f547bb6e2c298c3a2624e41"} {"level":"info","ts":"2026-07-17T18:54:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7d6585aaadca75431a1cb11a911b535a1f7cf9fdda74ed96f26a36af61839922"} {"level":"info","ts":"2026-07-17T18:54:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1034e87edcc60acffcc1726ada72c87ab9e703a9ed20297739dbe3c15f3851fe"} {"level":"info","ts":"2026-07-17T18:54:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6405b75b09f5af610151b0b5b031756a6b875d4350a7af4497727bd1c51515be"} {"level":"info","ts":"2026-07-17T18:54:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a600087833d415576a8ee82cdce85bfe7b28873d536c3f390a66795c2aa9b606"} {"level":"info","ts":"2026-07-17T18:54:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c52a7edef566cc942e6474f590e8219de2464b0730f6a8dae53af1d9cb29e5fb"} {"level":"info","ts":"2026-07-17T18:54:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9be6c38b5df7207656e6fd32bbf2bd974dfe9a021194c0ebd9c1472237e7174a"} {"level":"info","ts":"2026-07-17T18:54:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3aff30c32583124cf3700ab2dd5c5c49cae902e493acfe5eba643b91e573fa75"} {"level":"info","ts":"2026-07-17T18:54:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8605e1694f7fcc5c65302a747d1d2964f7153e4d3b2304e2862cb09a6e4a71d4"} {"level":"debug","ts":"2026-07-17T18:54:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"debug","ts":"2026-07-17T18:54:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"error","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d"} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"info","ts":"2026-07-17T18:54:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5"} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247"} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"error","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247"} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247"} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b"} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b"} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b"} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b"} {"level":"error","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"error","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:54:42Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:54:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d"} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f"} {"level":"error","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f"} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7"} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7"} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f"} {"level":"info","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7"} {"level":"debug","ts":"2026-07-17T18:55:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:04Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737"} {"level":"info","ts":"2026-07-17T18:55:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737"} {"level":"debug","ts":"2026-07-17T18:55:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:05Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:05Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737"} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5"} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5"} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5"} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7"} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"info","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"error","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"50812e861a0a811263a0a9689511fbc4bc934102baae79e7d5fec62ed5b87f7a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/50812e861a0a811263a0a9689511fbc4bc934102baae79e7d5fec62ed5b87f7a"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2b9ec3296686b0e4c3dc408f3c4de68752ac2ebb5a086379f3b708966aca6ff0","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a40fe13fe61027efb0e1869293589abde44a999eb4750fe2150708dcc76a008f","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b9ec3296686b0e4c3dc408f3c4de68752ac2ebb5a086379f3b708966aca6ff0"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:55:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a40fe13fe61027efb0e1869293589abde44a999eb4750fe2150708dcc76a008f"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e2ad691b88a49a2bd2c94f920a10629da0ab6464166f1f89fcb6cf73d259f778","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"} {"level":"debug","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e2ad691b88a49a2bd2c94f920a10629da0ab6464166f1f89fcb6cf73d259f778"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f"} {"level":"info","ts":"2026-07-17T18:55:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247"} {"level":"info","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55048","PortSpecifier":{"PortValue":55048}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55048","PortSpecifier":{"PortValue":55048}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314529,"nanos":374808706},"http":{"id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/sub-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e11b4c2d-188b-456e-ad87-e1e93a6a77bd","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2faf0607-9043-4dd6-912a-5199eec91749","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55818","PortSpecifier":{"PortValue":55818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2faf0607-9043-4dd6-912a-5199eec91749","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2faf0607-9043-4dd6-912a-5199eec91749","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55818","PortSpecifier":{"PortValue":55818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314529,"nanos":416390202},"http":{"id":"2faf0607-9043-4dd6-912a-5199eec91749","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2faf0607-9043-4dd6-912a-5199eec91749","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2faf0607-9043-4dd6-912a-5199eec91749","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2faf0607-9043-4dd6-912a-5199eec91749","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2faf0607-9043-4dd6-912a-5199eec91749","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2faf0607-9043-4dd6-912a-5199eec91749","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2faf0607-9043-4dd6-912a-5199eec91749","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/sub-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2faf0607-9043-4dd6-912a-5199eec91749","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2faf0607-9043-4dd6-912a-5199eec91749","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2faf0607-9043-4dd6-912a-5199eec91749","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2faf0607-9043-4dd6-912a-5199eec91749","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2faf0607-9043-4dd6-912a-5199eec91749","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55052","PortSpecifier":{"PortValue":55052}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb99b38d-b14b-47f1-84d6-328abc340c71","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55052","PortSpecifier":{"PortValue":55052}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314529,"nanos":453249046},"http":{"id":"cb99b38d-b14b-47f1-84d6-328abc340c71","method":"GET","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-2TGJrVtwCaTE5lWS_ZAWgrZN9qjbeoH3UuE7wP6f53d6q3DKW5k9acQV2kOO"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-2TGJrVtwCaTE5lWS_ZAWgrZN9qjbeoH3UuE7wP6f53d6q3DKW5k9acQV2kOO\"}"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"04f9100a-3298-4fe8-b160-509ade7bdb53","keyName":"e2e-sub-iso-32ec6b","subscription":"e2e-a-only-70836d","tenant":"e2e-shared-a-7d6f90","userId":"04f9100a-3298-4fe8-b160-509ade7bdb53","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/sub-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-70836d"} {"level":"info","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb99b38d-b14b-47f1-84d6-328abc340c71","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55832","PortSpecifier":{"PortValue":55832}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:55832","PortSpecifier":{"PortValue":55832}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314529,"nanos":501195110},"http":{"id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","method":"GET","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-hzGFN9ljiNgAferw_hZGbGoiGLfGPcnzBe1d6A8anNOz1tyQn4CIRV1UaWPW"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-hzGFN9ljiNgAferw_hZGbGoiGLfGPcnzBe1d6A8anNOz1tyQn4CIRV1UaWPW\"}"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"84af8295-59d4-4d6e-9c59-57d4a100ca8f","keyName":"e2e-sub-iso-3542f8","subscription":"e2e-b-only-70836d","tenant":"e2e-shared-b-52fc47","userId":"84af8295-59d4-4d6e-9c59-57d4a100ca8f","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/sub-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-70836d"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"} {"level":"info","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:55:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db1b7d1a-53b6-45aa-a942-13630f7e366b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40976","PortSpecifier":{"PortValue":40976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40976","PortSpecifier":{"PortValue":40976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314548,"nanos":91197658},"http":{"id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/sub-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6763f2be-f240-4f97-bbd2-49caa17cb5a3","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e30eae23-593e-4149-ab62-ce1dca474166","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41106","PortSpecifier":{"PortValue":41106}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e30eae23-593e-4149-ab62-ce1dca474166","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e30eae23-593e-4149-ab62-ce1dca474166","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41106","PortSpecifier":{"PortValue":41106}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314548,"nanos":130145002},"http":{"id":"e30eae23-593e-4149-ab62-ce1dca474166","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e30eae23-593e-4149-ab62-ce1dca474166","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e30eae23-593e-4149-ab62-ce1dca474166","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e30eae23-593e-4149-ab62-ce1dca474166","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e30eae23-593e-4149-ab62-ce1dca474166","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e30eae23-593e-4149-ab62-ce1dca474166","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/sub-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e30eae23-593e-4149-ab62-ce1dca474166","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e30eae23-593e-4149-ab62-ce1dca474166","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e30eae23-593e-4149-ab62-ce1dca474166","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e30eae23-593e-4149-ab62-ce1dca474166","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e30eae23-593e-4149-ab62-ce1dca474166","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e30eae23-593e-4149-ab62-ce1dca474166","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40982","PortSpecifier":{"PortValue":40982}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"05197030-7339-484a-bc9d-fc01bf85ac35","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:40982","PortSpecifier":{"PortValue":40982}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314548,"nanos":170972851},"http":{"id":"05197030-7339-484a-bc9d-fc01bf85ac35","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6dCnj8otzapW0Gu5_AVX2ZtAX6dRtKLb0gDtS2lqKtk6wosDDOr2tAsbiIEw"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6dCnj8otzapW0Gu5_AVX2ZtAX6dRtKLb0gDtS2lqKtk6wosDDOr2tAsbiIEw\"}"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"caae5d45-c4b8-4a28-a6bf-7681c71b5650","keyName":"e2e-sub-iso-1862f1","subscription":"e2e-shared-sub-653501","tenant":"e2e-shared-a-7d6f90","userId":"caae5d45-c4b8-4a28-a6bf-7681c71b5650","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/sub-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-653501"} {"level":"info","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"05197030-7339-484a-bc9d-fc01bf85ac35","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41120","PortSpecifier":{"PortValue":41120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:41120","PortSpecifier":{"PortValue":41120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314548,"nanos":204279093},"http":{"id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-nPeBva7bhEHK6D71_NVd0dmhqdHCdOtXjtuFGaDmEqjFjL7xSYBTnxmtNLXq"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-nPeBva7bhEHK6D71_NVd0dmhqdHCdOtXjtuFGaDmEqjFjL7xSYBTnxmtNLXq\"}"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e41e3a44-7a6c-4965-bbcb-bd55ab8d1b48","keyName":"e2e-sub-iso-f0ca3b","subscription":"e2e-shared-sub-653501","tenant":"e2e-shared-b-52fc47","userId":"e41e3a44-7a6c-4965-bbcb-bd55ab8d1b48","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/sub-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-653501"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"} {"level":"info","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4579d2e-ce8a-4d93-a6d1-88715638ee2e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6f50dbbd1ae4af4855523f4822643131a3e17fdc8fc418959077e74db3504b81"} {"level":"info","ts":"2026-07-17T18:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1c91b8a259b5ab652b58a0bb17ff4a152af954033e31bb03fe683551bbd2d258"} {"level":"info","ts":"2026-07-17T18:55:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/935dc5164e8f8b550eeca68c4a09c7a6597c462be42b4fe0ee013b3b88025eb5"} {"level":"info","ts":"2026-07-17T18:55:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/374bf7088d037f9666aa9ff562194f0177f90cb89530c2c78d849d21b698e247"} {"level":"info","ts":"2026-07-17T18:55:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4d9cf2d0f354d4ab3a3cce20c4e4ad3e894f32e90f95fe7f69fcd5d5367bcd4d"} {"level":"info","ts":"2026-07-17T18:55:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dfe75edd8403f240c08cb40335ad8be190664c92645bbddcc5e739676e287fe2"} {"level":"info","ts":"2026-07-17T18:55:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/36ac2e37c125458f84627823fa851677e51c7acedb5ac2b782a3a06848a61f39"} {"level":"info","ts":"2026-07-17T18:55:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f7b1891221b8b2d8a3deaea35fe9c57d62e6ca1bc6f35f8bd49636551f75a91b"} {"level":"info","ts":"2026-07-17T18:56:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cf0d79180e5b7e66ac4ee597c7aff31067304a139c6692b103545b49db5c03c6"} {"level":"info","ts":"2026-07-17T18:56:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/137608f894c19f5325c172f34495ba18fc2d3c9bf6848bb7d0793cf112d16081"} {"level":"info","ts":"2026-07-17T18:56:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/530b9db4b54a2c618fa482c80f57c0379f30776ecf2d7c15986d3fa59b5a3737"} {"level":"info","ts":"2026-07-17T18:56:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/143080520f5407e29f76fa70450d5cafec9b6c93b6e3542c5b957248ff36521d"} {"level":"info","ts":"2026-07-17T18:56:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/61f17ede9b6739407ce4e3b6d876505227bb377d2bc176ecddffa55cb7f2a6f7"} {"level":"info","ts":"2026-07-17T18:56:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/161e0159b401d3e4004fd389478039905919a9a38e097c3e55a3ba52c521f38f"} {"level":"info","ts":"2026-07-17T18:56:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1eee7870a8a8e2b98ad28e336ba96d0fcb47f6a1068f8d55640dddd06f7222d0"} {"level":"info","ts":"2026-07-17T18:56:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8b4a31b27e6c7be15a580c83b9410dc07a3d5eb47084c440baff9689386519b2"} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d"} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"error","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d"} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d"} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d"} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d"} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d"} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:15Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"debug","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"} {"level":"error","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"} {"level":"error","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634"} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634"} {"level":"info","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e"} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634"} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e"} {"level":"debug","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634"} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd"} {"level":"info","ts":"2026-07-17T18:56:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e"} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06"} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06"} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76"} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76"} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76"} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"info","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:40Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6"} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:41Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"debug","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"} {"level":"info","ts":"2026-07-17T18:56:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e"} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a40fe13fe61027efb0e1869293589abde44a999eb4750fe2150708dcc76a008f","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a40fe13fe61027efb0e1869293589abde44a999eb4750fe2150708dcc76a008f"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2b9ec3296686b0e4c3dc408f3c4de68752ac2ebb5a086379f3b708966aca6ff0","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b9ec3296686b0e4c3dc408f3c4de68752ac2ebb5a086379f3b708966aca6ff0"} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"error","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3"} {"level":"error","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"} {"level":"error","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6"} {"level":"error","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"50812e861a0a811263a0a9689511fbc4bc934102baae79e7d5fec62ed5b87f7a","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"error","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/50812e861a0a811263a0a9689511fbc4bc934102baae79e7d5fec62ed5b87f7a"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e2ad691b88a49a2bd2c94f920a10629da0ab6464166f1f89fcb6cf73d259f778","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06"} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e2ad691b88a49a2bd2c94f920a10629da0ab6464166f1f89fcb6cf73d259f778"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988"} {"level":"info","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-17T18:56:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-17T18:56:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"info","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-17T18:56:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-17T18:56:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}} {"level":"info","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd"} {"level":"error","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"} {"level":"debug","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"debug","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96","namespace":"kuadrant-system"}} {"level":"info","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d"} {"level":"info","ts":"2026-07-17T18:56:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"info","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38812","PortSpecifier":{"PortValue":38812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38812","PortSpecifier":{"PortValue":38812}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314616,"nanos":932580106},"http":{"id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3c7b4795-d126-4c2b-82c0-4649bdf603ee","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5c163a5-e256-4734-854c-c14df2452d11","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34262","PortSpecifier":{"PortValue":34262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e5c163a5-e256-4734-854c-c14df2452d11","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5c163a5-e256-4734-854c-c14df2452d11","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34262","PortSpecifier":{"PortValue":34262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314616,"nanos":973544815},"http":{"id":"e5c163a5-e256-4734-854c-c14df2452d11","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e5c163a5-e256-4734-854c-c14df2452d11","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e5c163a5-e256-4734-854c-c14df2452d11","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e5c163a5-e256-4734-854c-c14df2452d11","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5c163a5-e256-4734-854c-c14df2452d11","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5c163a5-e256-4734-854c-c14df2452d11","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5c163a5-e256-4734-854c-c14df2452d11","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e5c163a5-e256-4734-854c-c14df2452d11","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5c163a5-e256-4734-854c-c14df2452d11","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5c163a5-e256-4734-854c-c14df2452d11","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"info","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5c163a5-e256-4734-854c-c14df2452d11","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:56:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5c163a5-e256-4734-854c-c14df2452d11","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17f40dc2-633e-4545-a637-fe51f1928966","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38828","PortSpecifier":{"PortValue":38828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"17f40dc2-633e-4545-a637-fe51f1928966","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17f40dc2-633e-4545-a637-fe51f1928966","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38828","PortSpecifier":{"PortValue":38828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314617,"nanos":13864438},"http":{"id":"17f40dc2-633e-4545-a637-fe51f1928966","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"17f40dc2-633e-4545-a637-fe51f1928966","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17f40dc2-633e-4545-a637-fe51f1928966","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17f40dc2-633e-4545-a637-fe51f1928966","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38840","PortSpecifier":{"PortValue":38840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38840","PortSpecifier":{"PortValue":38840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314618,"nanos":80332758},"http":{"id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38850","PortSpecifier":{"PortValue":38850}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38850","PortSpecifier":{"PortValue":38850}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314619,"nanos":118790355},"http":{"id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38854","PortSpecifier":{"PortValue":38854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38854","PortSpecifier":{"PortValue":38854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314620,"nanos":159545349},"http":{"id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38860","PortSpecifier":{"PortValue":38860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38860","PortSpecifier":{"PortValue":38860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314621,"nanos":197768232},"http":{"id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52824","PortSpecifier":{"PortValue":52824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aae4c440-d487-4921-b73a-54ed12e2d755","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52824","PortSpecifier":{"PortValue":52824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314622,"nanos":233623656},"http":{"id":"aae4c440-d487-4921-b73a-54ed12e2d755","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3243e89b-6450-486b-91fb-8800c02f9418","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52836","PortSpecifier":{"PortValue":52836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3243e89b-6450-486b-91fb-8800c02f9418","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3243e89b-6450-486b-91fb-8800c02f9418","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52836","PortSpecifier":{"PortValue":52836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314623,"nanos":270504321},"http":{"id":"3243e89b-6450-486b-91fb-8800c02f9418","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3243e89b-6450-486b-91fb-8800c02f9418","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3243e89b-6450-486b-91fb-8800c02f9418","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3243e89b-6450-486b-91fb-8800c02f9418","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52838","PortSpecifier":{"PortValue":52838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52838","PortSpecifier":{"PortValue":52838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314624,"nanos":318463207},"http":{"id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52846","PortSpecifier":{"PortValue":52846}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52846","PortSpecifier":{"PortValue":52846}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314625,"nanos":355785066},"http":{"id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52854","PortSpecifier":{"PortValue":52854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52854","PortSpecifier":{"PortValue":52854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314626,"nanos":393094836},"http":{"id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"041da20e-d893-45e0-b16e-c67b57708146","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52864","PortSpecifier":{"PortValue":52864}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"041da20e-d893-45e0-b16e-c67b57708146","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"041da20e-d893-45e0-b16e-c67b57708146","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52864","PortSpecifier":{"PortValue":52864}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314627,"nanos":429804790},"http":{"id":"041da20e-d893-45e0-b16e-c67b57708146","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"041da20e-d893-45e0-b16e-c67b57708146","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"041da20e-d893-45e0-b16e-c67b57708146","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"041da20e-d893-45e0-b16e-c67b57708146","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52874","PortSpecifier":{"PortValue":52874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52874","PortSpecifier":{"PortValue":52874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314628,"nanos":466899426},"http":{"id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52876","PortSpecifier":{"PortValue":52876}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52876","PortSpecifier":{"PortValue":52876}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314629,"nanos":501704621},"http":{"id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36998","PortSpecifier":{"PortValue":36998}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"610fb170-4fdd-4e1a-8345-c395d77493e1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36998","PortSpecifier":{"PortValue":36998}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314638,"nanos":262877724},"http":{"id":"610fb170-4fdd-4e1a-8345-c395d77493e1","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0a88b26-068a-493b-83fe-5ef588515299","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:49580","PortSpecifier":{"PortValue":49580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d0a88b26-068a-493b-83fe-5ef588515299","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0a88b26-068a-493b-83fe-5ef588515299","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:49580","PortSpecifier":{"PortValue":49580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314638,"nanos":300707153},"http":{"id":"d0a88b26-068a-493b-83fe-5ef588515299","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d0a88b26-068a-493b-83fe-5ef588515299","tokenreview":{"name":""}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d0a88b26-068a-493b-83fe-5ef588515299","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0a88b26-068a-493b-83fe-5ef588515299","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0a88b26-068a-493b-83fe-5ef588515299","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37002","PortSpecifier":{"PortValue":37002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37002","PortSpecifier":{"PortValue":37002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314638,"nanos":338143994},"http":{"id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37012","PortSpecifier":{"PortValue":37012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37012","PortSpecifier":{"PortValue":37012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314639,"nanos":372785615},"http":{"id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37022","PortSpecifier":{"PortValue":37022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37022","PortSpecifier":{"PortValue":37022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314640,"nanos":410578357},"http":{"id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37036","PortSpecifier":{"PortValue":37036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37036","PortSpecifier":{"PortValue":37036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314641,"nanos":446736586},"http":{"id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33220","PortSpecifier":{"PortValue":33220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33220","PortSpecifier":{"PortValue":33220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314642,"nanos":480618484},"http":{"id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33226","PortSpecifier":{"PortValue":33226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33226","PortSpecifier":{"PortValue":33226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314643,"nanos":515640051},"http":{"id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33228","PortSpecifier":{"PortValue":33228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33228","PortSpecifier":{"PortValue":33228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314644,"nanos":551187524},"http":{"id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33244","PortSpecifier":{"PortValue":33244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33244","PortSpecifier":{"PortValue":33244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314645,"nanos":585976169},"http":{"id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33254","PortSpecifier":{"PortValue":33254}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33254","PortSpecifier":{"PortValue":33254}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314646,"nanos":622771228},"http":{"id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33260","PortSpecifier":{"PortValue":33260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33260","PortSpecifier":{"PortValue":33260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314647,"nanos":658675451},"http":{"id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33262","PortSpecifier":{"PortValue":33262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9ce392f4-53d0-4433-9894-e65ca32df24f","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33262","PortSpecifier":{"PortValue":33262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314648,"nanos":694375494},"http":{"id":"9ce392f4-53d0-4433-9894-e65ca32df24f","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34436","PortSpecifier":{"PortValue":34436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","method":"POST","path":"/ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47/v1/completions","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34436","PortSpecifier":{"PortValue":34436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314648,"nanos":733819414},"http":{"id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-hfZi2UBDReXkQTzp_Rs0orSZEsVXnOvUo5T153Sv4t9LRP1FJjqHbDnuRRm2"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-hfZi2UBDReXkQTzp_Rs0orSZEsVXnOvUo5T153Sv4t9LRP1FJjqHbDnuRRm2\"}"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"121fbcd4-7eba-4364-9a76-2dcfbf3cfa68","keyName":"e2e-rate-b-e85138","subscription":"e2e-rate-iso-b-e85138","tenant":"e2e-shared-b-52fc47","userId":"121fbcd4-7eba-4364-9a76-2dcfbf3cfa68","username":"system:serviceaccount:default:tester-regular-user","valid":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47\",\"requestedSubscription\":\"e2e-rate-iso-b-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-52fc47","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e85138","namespace":"ai-tenant-e2e-shared-b-52fc47","phase":"Active","ready":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer **** {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n object.get(input.auth.metadata, \"apiKeyValidation\", {})\n input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-e85138"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"121fbcd4-7eba-4364-9a76-2dcfbf3cfa68","keyName":"e2e-rate-b-e85138","selected_subscription":"e2e-rate-iso-b-e85138","selected_subscription_key":"ai-tenant-e2e-shared-b-52fc47/e2e-rate-iso-b-e85138@ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-52fc47","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e85138","namespace":"ai-tenant-e2e-shared-b-52fc47","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}} {"level":"info","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","authorized":true,"response":"OK"} {"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","authorized":true,"response":"OK"} {"level":"info","ts":"2026-07-17T18:57:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"} {"level":"info","ts":"2026-07-17T18:57:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"} {"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd"} {"level":"info","ts":"2026-07-17T18:58:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/50812e861a0a811263a0a9689511fbc4bc934102baae79e7d5fec62ed5b87f7a"} {"level":"info","ts":"2026-07-17T18:58:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"} {"level":"info","ts":"2026-07-17T18:58:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e2ad691b88a49a2bd2c94f920a10629da0ab6464166f1f89fcb6cf73d259f778"} {"level":"info","ts":"2026-07-17T18:58:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2b9ec3296686b0e4c3dc408f3c4de68752ac2ebb5a086379f3b708966aca6ff0"} {"level":"info","ts":"2026-07-17T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"} {"level":"info","ts":"2026-07-17T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a40fe13fe61027efb0e1869293589abde44a999eb4750fe2150708dcc76a008f"} {"level":"info","ts":"2026-07-17T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"} {"level":"info","ts":"2026-07-17T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"}