{"level":"info","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17f40dc2-633e-4545-a637-fe51f1928966","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38828","PortSpecifier":{"PortValue":38828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"17f40dc2-633e-4545-a637-fe51f1928966","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17f40dc2-633e-4545-a637-fe51f1928966","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38828","PortSpecifier":{"PortValue":38828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314617,"nanos":13864438},"http":{"id":"17f40dc2-633e-4545-a637-fe51f1928966","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"17f40dc2-633e-4545-a637-fe51f1928966","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17f40dc2-633e-4545-a637-fe51f1928966","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17f40dc2-633e-4545-a637-fe51f1928966","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:56:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17f40dc2-633e-4545-a637-fe51f1928966","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38840","PortSpecifier":{"PortValue":38840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38840","PortSpecifier":{"PortValue":38840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314618,"nanos":80332758},"http":{"id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:56:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e81710d-5449-4cb9-971d-5f78d4ab4e93","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38850","PortSpecifier":{"PortValue":38850}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38850","PortSpecifier":{"PortValue":38850}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314619,"nanos":118790355},"http":{"id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:56:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f7c78c8-a7b4-4c69-9945-28024e220c7f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38854","PortSpecifier":{"PortValue":38854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38854","PortSpecifier":{"PortValue":38854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314620,"nanos":159545349},"http":{"id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa0bc477-925b-4ea3-bd8b-f07f69b52d01","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38860","PortSpecifier":{"PortValue":38860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38860","PortSpecifier":{"PortValue":38860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314621,"nanos":197768232},"http":{"id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5829b51a-0136-4333-afb9-5cfedd0c48d0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52824","PortSpecifier":{"PortValue":52824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aae4c440-d487-4921-b73a-54ed12e2d755","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52824","PortSpecifier":{"PortValue":52824}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314622,"nanos":233623656},"http":{"id":"aae4c440-d487-4921-b73a-54ed12e2d755","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aae4c440-d487-4921-b73a-54ed12e2d755","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3243e89b-6450-486b-91fb-8800c02f9418","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52836","PortSpecifier":{"PortValue":52836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3243e89b-6450-486b-91fb-8800c02f9418","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3243e89b-6450-486b-91fb-8800c02f9418","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52836","PortSpecifier":{"PortValue":52836}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314623,"nanos":270504321},"http":{"id":"3243e89b-6450-486b-91fb-8800c02f9418","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3243e89b-6450-486b-91fb-8800c02f9418","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3243e89b-6450-486b-91fb-8800c02f9418","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3243e89b-6450-486b-91fb-8800c02f9418","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3243e89b-6450-486b-91fb-8800c02f9418","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52838","PortSpecifier":{"PortValue":52838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52838","PortSpecifier":{"PortValue":52838}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314624,"nanos":318463207},"http":{"id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9126257-fbe3-4e58-a88d-15d09e6d95f1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52846","PortSpecifier":{"PortValue":52846}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52846","PortSpecifier":{"PortValue":52846}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314625,"nanos":355785066},"http":{"id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"49ee6aad-3aef-47dc-a98e-0447f9099c19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52854","PortSpecifier":{"PortValue":52854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52854","PortSpecifier":{"PortValue":52854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314626,"nanos":393094836},"http":{"id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bc855e12-b2ed-42d3-9a30-48e3bac2dfbf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"041da20e-d893-45e0-b16e-c67b57708146","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52864","PortSpecifier":{"PortValue":52864}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"041da20e-d893-45e0-b16e-c67b57708146","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"041da20e-d893-45e0-b16e-c67b57708146","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52864","PortSpecifier":{"PortValue":52864}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314627,"nanos":429804790},"http":{"id":"041da20e-d893-45e0-b16e-c67b57708146","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"041da20e-d893-45e0-b16e-c67b57708146","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"041da20e-d893-45e0-b16e-c67b57708146","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"041da20e-d893-45e0-b16e-c67b57708146","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"041da20e-d893-45e0-b16e-c67b57708146","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52874","PortSpecifier":{"PortValue":52874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52874","PortSpecifier":{"PortValue":52874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314628,"nanos":466899426},"http":{"id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b5f0d03d-043d-4f6e-9c01-0ebcfa8d797b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52876","PortSpecifier":{"PortValue":52876}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:52876","PortSpecifier":{"PortValue":52876}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314629,"nanos":501704621},"http":{"id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV"}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Gzfumcts5aqiqPkI_6QLs1dwZnivZNh6Uvq4ZwyDMt2nQrAILcyZW6GU0zDV\"}"}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","subscription":"e2e-rate-iso-a-6aadb0","tenant":"e2e-shared-a-7d6f90","userId":"8db88ea3-05ad-46cb-9638-be63818d23f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-6aadb0\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6aadb0"}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"8db88ea3-05ad-46cb-9638-be63818d23f3","keyName":"e2e-rate-a-6aadb0","selected_subscription":"e2e-rate-iso-a-6aadb0","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-6aadb0@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6aadb0","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"edb60d24-2146-44ae-a78d-e09b0b4a90b4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36998","PortSpecifier":{"PortValue":36998}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"610fb170-4fdd-4e1a-8345-c395d77493e1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36998","PortSpecifier":{"PortValue":36998}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314638,"nanos":262877724},"http":{"id":"610fb170-4fdd-4e1a-8345-c395d77493e1","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.104:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"610fb170-4fdd-4e1a-8345-c395d77493e1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0a88b26-068a-493b-83fe-5ef588515299","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:49580","PortSpecifier":{"PortValue":49580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d0a88b26-068a-493b-83fe-5ef588515299","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0a88b26-068a-493b-83fe-5ef588515299","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:49580","PortSpecifier":{"PortValue":49580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314638,"nanos":300707153},"http":{"id":"d0a88b26-068a-493b-83fe-5ef588515299","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d0a88b26-068a-493b-83fe-5ef588515299","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"]}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d0a88b26-068a-493b-83fe-5ef588515299","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/f9a623d3e101"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=530d4330-0580-41bb-b23b-e1e1466f6e85"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5cccbceb-c57c-4cfe-b568-499d8f5a1b57","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.107:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0a88b26-068a-493b-83fe-5ef588515299","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0a88b26-068a-493b-83fe-5ef588515299","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0a88b26-068a-493b-83fe-5ef588515299","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37002","PortSpecifier":{"PortValue":37002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37002","PortSpecifier":{"PortValue":37002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314638,"nanos":338143994},"http":{"id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e2b790a-3ef3-4408-b4e8-4dfe1e377e63","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37012","PortSpecifier":{"PortValue":37012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37012","PortSpecifier":{"PortValue":37012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314639,"nanos":372785615},"http":{"id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8aff4b92-bddf-4e79-85f1-3bfdce094a41","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37022","PortSpecifier":{"PortValue":37022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37022","PortSpecifier":{"PortValue":37022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314640,"nanos":410578357},"http":{"id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4f1ace0-fe16-4127-afb0-4bbb6019746c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37036","PortSpecifier":{"PortValue":37036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:37036","PortSpecifier":{"PortValue":37036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314641,"nanos":446736586},"http":{"id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c74cc2e8-df82-4ef2-80ac-de7fbd711ff3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33220","PortSpecifier":{"PortValue":33220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33220","PortSpecifier":{"PortValue":33220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314642,"nanos":480618484},"http":{"id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f028cb4-39a1-4ad0-9db8-d6f27605bf64","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33226","PortSpecifier":{"PortValue":33226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33226","PortSpecifier":{"PortValue":33226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314643,"nanos":515640051},"http":{"id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"64c5a805-8344-4408-9a1c-0a8668cf6ed0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33228","PortSpecifier":{"PortValue":33228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33228","PortSpecifier":{"PortValue":33228}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314644,"nanos":551187524},"http":{"id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c8b8d8f-b5c8-438b-8218-31c900f7e05a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33244","PortSpecifier":{"PortValue":33244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33244","PortSpecifier":{"PortValue":33244}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314645,"nanos":585976169},"http":{"id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9093d4a8-4c80-4059-98fd-e2c5d979d06e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33254","PortSpecifier":{"PortValue":33254}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33254","PortSpecifier":{"PortValue":33254}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314646,"nanos":622771228},"http":{"id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dd01fef0-2c6a-4796-a15c-c39e849e1103","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33260","PortSpecifier":{"PortValue":33260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33260","PortSpecifier":{"PortValue":33260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314647,"nanos":658675451},"http":{"id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"84ecaa3d-1226-47bf-8bfc-e6aeeca14fef","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33262","PortSpecifier":{"PortValue":33262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9ce392f4-53d0-4433-9894-e65ca32df24f","method":"POST","path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions","host":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:33262","PortSpecifier":{"PortValue":33262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.104:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314648,"nanos":694375494},"http":{"id":"9ce392f4-53d0-4433-9894-e65ca32df24f","method":"POST","headers":{":authority":"e2e-shared-a-7d6f90.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tR16gA2IOLsUFHpq_9eI222d9lUECAerKflmqOM6tpvWVAxASH7fwwljzavb\"}"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","subscription":"e2e-rate-iso-a-e85138","tenant":"e2e-shared-a-7d6f90","userId":"019049d5-6d02-4fd1-85b4-90b0794e988e","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\",\"requestedSubscription\":\"e2e-rate-iso-a-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7d6f90.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7d6f90/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"019049d5-6d02-4fd1-85b4-90b0794e988e","keyName":"e2e-rate-a-e85138","selected_subscription":"e2e-rate-iso-a-e85138","selected_subscription_key":"ai-tenant-e2e-shared-a-7d6f90/e2e-rate-iso-a-e85138@ai-tenant-e2e-shared-a-7d6f90/rate-test-model-7d6f90","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7d6f90","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e85138","namespace":"ai-tenant-e2e-shared-a-7d6f90","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ce392f4-53d0-4433-9894-e65ca32df24f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34436","PortSpecifier":{"PortValue":34436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","method":"POST","path":"/ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47/v1/completions","host":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:34436","PortSpecifier":{"PortValue":34436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.107:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784314648,"nanos":733819414},"http":{"id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","method":"POST","headers":{":authority":"e2e-shared-b-52fc47.apps.30e27918-1f12-4191-9045-f9a623d3e101.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-hfZi2UBDReXkQTzp_Rs0orSZEsVXnOvUo5T153Sv4t9LRP1FJjqHbDnuRRm2"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-hfZi2UBDReXkQTzp_Rs0orSZEsVXnOvUo5T153Sv4t9LRP1FJjqHbDnuRRm2\"}"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"121fbcd4-7eba-4364-9a76-2dcfbf3cfa68","keyName":"e2e-rate-b-e85138","subscription":"e2e-rate-iso-b-e85138","tenant":"e2e-shared-b-52fc47","userId":"121fbcd4-7eba-4364-9a76-2dcfbf3cfa68","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47\",\"requestedSubscription\":\"e2e-rate-iso-b-e85138\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-52fc47.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-52fc47","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e85138","namespace":"ai-tenant-e2e-shared-b-52fc47","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-52fc47/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-e85138"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"121fbcd4-7eba-4364-9a76-2dcfbf3cfa68","keyName":"e2e-rate-b-e85138","selected_subscription":"e2e-rate-iso-b-e85138","selected_subscription_key":"ai-tenant-e2e-shared-b-52fc47/e2e-rate-iso-b-e85138@ai-tenant-e2e-shared-b-52fc47/rate-test-model-52fc47","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-52fc47","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-e85138","namespace":"ai-tenant-e2e-shared-b-52fc47","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-17T18:57:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e6df910a-82e2-4de1-ac74-5406d1417f5f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-17T18:57:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9493afcd2a648ee23f2f840a697cbbc083f8fa2fb003f51911d6d3a02a0f2c9d"}
{"level":"info","ts":"2026-07-17T18:57:37Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f295fc2a6fdbe7c4753ba896105c97b3069726e37946dc6cd9a0e55f5892a988"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e26b242b9deb6af71635b6d95bfba512a51788f0792090e0ebd761bda32002f4"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/29327cf54b833c57c4d5b2b890b6ed1d0eccfa3048eb38ddd54db7c89424a61d"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f97abe50427ede7d9944d6a93f49a3265b2e8e0db32def669f4e0ade74920634"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d793c19d49f86707f69a4271f641707be2199ff46cfd7671f121c3ad867cce96"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/35c8f25c5f6bef54ffbd625cb467d2592978048f32706b80e8b45697769e8c76"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c0495a5f84a390f9563c85b65009d7cd7f9be404b6ae27d2531ef67852acb0a5"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c785886bcf4090e566312246d394e2ad109276eef4690195c5f3fdcd725b39c3"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/01fa61fb3325eec6b0ac2bfb1c8010a3fe553802e7eafafde89c7b2f52baaf3e"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/db6c0d223983c0c1ac0621be10f457fc9fc68be4b82c37bcb526b7a459b31c06"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a1f8aa1e2144a92eaa33eeade50a54f82838f5363829b0fcc2a1aaf5289427cc"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a68482234efaf3dad282e395ce0eed33507a817cd9b889802c50e8e279fe08f6"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c27d532087f6256c11d724f96a4166eba14aaef4adbba6d89e1ec92b9fe4c459"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fa36dac77fd79622ed2b40543f3fb9a6b14b0d7ce99cdc0d87b36c4d4701ada8"}
{"level":"info","ts":"2026-07-17T18:57:38Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8c2365e0b4c3671111be8bb7708463d8ab5824ba2f988858d548d3ed4f5aeccd"}
{"level":"info","ts":"2026-07-17T18:58:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/50812e861a0a811263a0a9689511fbc4bc934102baae79e7d5fec62ed5b87f7a"}
{"level":"info","ts":"2026-07-17T18:58:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6acff2ce6bfa500cc8fc1c1b829652fc891616d5d0e95616dbfe76099b1d45ae"}
{"level":"info","ts":"2026-07-17T18:58:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e2ad691b88a49a2bd2c94f920a10629da0ab6464166f1f89fcb6cf73d259f778"}
{"level":"info","ts":"2026-07-17T18:58:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2b9ec3296686b0e4c3dc408f3c4de68752ac2ebb5a086379f3b708966aca6ff0"}
{"level":"info","ts":"2026-07-17T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07690d63fcc2aab360a0fcc66100619af0cb9c176deb8a3c1f54a94206d7abc7"}
{"level":"info","ts":"2026-07-17T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a40fe13fe61027efb0e1869293589abde44a999eb4750fe2150708dcc76a008f"}
{"level":"info","ts":"2026-07-17T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/56d7f7a4502a3f920ca348e3a39a3834d6f4541075bedcb18ac7ea6a0be9c64a"}
{"level":"info","ts":"2026-07-17T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/307988b9e445422d370496ac762896cdd6b33889b385b35e1b2167be5bac7a53"}