{"level":"info","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2feb4ff2e1ad1e846cee14829fbf90d29b8db51eda421ec166aabbc0cbcaaa3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3499548247a7cd35abe24269c369e01fe4f252fccf50fc8b1880044eb64b733f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2feb4ff2e1ad1e846cee14829fbf90d29b8db51eda421ec166aabbc0cbcaaa3c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4795852c0a3f908ef7f986c8716c0ba7c789b8177b42bba53f2230185a28160"}
{"level":"info","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3499548247a7cd35abe24269c369e01fe4f252fccf50fc8b1880044eb64b733f"}
{"level":"info","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2feb4ff2e1ad1e846cee14829fbf90d29b8db51eda421ec166aabbc0cbcaaa3c"}
{"level":"debug","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101"}
{"level":"debug","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9"}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b4af8d984e96cb5fcda6672a832ccdfb5a69c9439a47198cf13ef8f668dc2cef","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b4af8d984e96cb5fcda6672a832ccdfb5a69c9439a47198cf13ef8f668dc2cef"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b4af8d984e96cb5fcda6672a832ccdfb5a69c9439a47198cf13ef8f668dc2cef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b4af8d984e96cb5fcda6672a832ccdfb5a69c9439a47198cf13ef8f668dc2cef"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b4af8d984e96cb5fcda6672a832ccdfb5a69c9439a47198cf13ef8f668dc2cef","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:21Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b4af8d984e96cb5fcda6672a832ccdfb5a69c9439a47198cf13ef8f668dc2cef"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0de9302b34a9932f7543488bce2ce3b0911a58c1e34e6a9862aa029ad723677d"}
{"level":"info","ts":"2026-07-20T19:03:21Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1085746e154fba428198607c0290b6f0959819b0b5c4b9e605c0614436381726"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b4af8d984e96cb5fcda6672a832ccdfb5a69c9439a47198cf13ef8f668dc2cef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0de9302b34a9932f7543488bce2ce3b0911a58c1e34e6a9862aa029ad723677d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0de9302b34a9932f7543488bce2ce3b0911a58c1e34e6a9862aa029ad723677d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b4af8d984e96cb5fcda6672a832ccdfb5a69c9439a47198cf13ef8f668dc2cef"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0de9302b34a9932f7543488bce2ce3b0911a58c1e34e6a9862aa029ad723677d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1085746e154fba428198607c0290b6f0959819b0b5c4b9e605c0614436381726","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1085746e154fba428198607c0290b6f0959819b0b5c4b9e605c0614436381726"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5739185beebcadcef1405b4615e2878df458c618db4c5f7ff6c04cf7c54b596"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1d9ad652280ab832e4a0dfebf0a686a5d8c57f024d4139a9d9cba2d132e0f000"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1085746e154fba428198607c0290b6f0959819b0b5c4b9e605c0614436381726","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b4af8d984e96cb5fcda6672a832ccdfb5a69c9439a47198cf13ef8f668dc2cef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a5739185beebcadcef1405b4615e2878df458c618db4c5f7ff6c04cf7c54b596","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a5739185beebcadcef1405b4615e2878df458c618db4c5f7ff6c04cf7c54b596"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/72eb677c53c76295736e11b471a01b2869d9c844a89b29feba51e447b05cf679"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0de9302b34a9932f7543488bce2ce3b0911a58c1e34e6a9862aa029ad723677d"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a5739185beebcadcef1405b4615e2878df458c618db4c5f7ff6c04cf7c54b596","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1d9ad652280ab832e4a0dfebf0a686a5d8c57f024d4139a9d9cba2d132e0f000","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1d9ad652280ab832e4a0dfebf0a686a5d8c57f024d4139a9d9cba2d132e0f000"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6b3d649c4e439a791518c6e78b6e1fd461a8e35b5c83e35c65852dc071b2ee6"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1085746e154fba428198607c0290b6f0959819b0b5c4b9e605c0614436381726"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22deea6810ac900618063dc2353507ffadaaf2f0d0cd8a7911b44535e9dbf89b"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1d9ad652280ab832e4a0dfebf0a686a5d8c57f024d4139a9d9cba2d132e0f000","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"72eb677c53c76295736e11b471a01b2869d9c844a89b29feba51e447b05cf679","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["72eb677c53c76295736e11b471a01b2869d9c844a89b29feba51e447b05cf679"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db6fa2769fe37e466d1291aa29e31b5421243947cb3ef77ad1ca7dc48639d545"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e53ef4c04f4db89def5f6f77a5ce910fdc150b4c0841f81c45da75dcebad2adc"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"72eb677c53c76295736e11b471a01b2869d9c844a89b29feba51e447b05cf679","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0de9302b34a9932f7543488bce2ce3b0911a58c1e34e6a9862aa029ad723677d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b6b3d649c4e439a791518c6e78b6e1fd461a8e35b5c83e35c65852dc071b2ee6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b6b3d649c4e439a791518c6e78b6e1fd461a8e35b5c83e35c65852dc071b2ee6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a5739185beebcadcef1405b4615e2878df458c618db4c5f7ff6c04cf7c54b596"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/efe88a06696976cc3cebe1c32f87473147d0f479481023bd5c57017665a5c304"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1d9ad652280ab832e4a0dfebf0a686a5d8c57f024d4139a9d9cba2d132e0f000"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b6b3d649c4e439a791518c6e78b6e1fd461a8e35b5c83e35c65852dc071b2ee6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1085746e154fba428198607c0290b6f0959819b0b5c4b9e605c0614436381726","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"22deea6810ac900618063dc2353507ffadaaf2f0d0cd8a7911b44535e9dbf89b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["22deea6810ac900618063dc2353507ffadaaf2f0d0cd8a7911b44535e9dbf89b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9852b20147873e4dd9ddba9d9bda6378fa79b2557932a1e817230476c88d9569"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/72eb677c53c76295736e11b471a01b2869d9c844a89b29feba51e447b05cf679"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"22deea6810ac900618063dc2353507ffadaaf2f0d0cd8a7911b44535e9dbf89b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db6fa2769fe37e466d1291aa29e31b5421243947cb3ef77ad1ca7dc48639d545","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["db6fa2769fe37e466d1291aa29e31b5421243947cb3ef77ad1ca7dc48639d545"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b6b3d649c4e439a791518c6e78b6e1fd461a8e35b5c83e35c65852dc071b2ee6"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22deea6810ac900618063dc2353507ffadaaf2f0d0cd8a7911b44535e9dbf89b"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db6fa2769fe37e466d1291aa29e31b5421243947cb3ef77ad1ca7dc48639d545","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e53ef4c04f4db89def5f6f77a5ce910fdc150b4c0841f81c45da75dcebad2adc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e53ef4c04f4db89def5f6f77a5ce910fdc150b4c0841f81c45da75dcebad2adc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db6fa2769fe37e466d1291aa29e31b5421243947cb3ef77ad1ca7dc48639d545"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e53ef4c04f4db89def5f6f77a5ce910fdc150b4c0841f81c45da75dcebad2adc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a5739185beebcadcef1405b4615e2878df458c618db4c5f7ff6c04cf7c54b596","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"efe88a06696976cc3cebe1c32f87473147d0f479481023bd5c57017665a5c304","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["efe88a06696976cc3cebe1c32f87473147d0f479481023bd5c57017665a5c304"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e53ef4c04f4db89def5f6f77a5ce910fdc150b4c0841f81c45da75dcebad2adc"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"efe88a06696976cc3cebe1c32f87473147d0f479481023bd5c57017665a5c304","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1d9ad652280ab832e4a0dfebf0a686a5d8c57f024d4139a9d9cba2d132e0f000","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9852b20147873e4dd9ddba9d9bda6378fa79b2557932a1e817230476c88d9569","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-20T19:03:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9852b20147873e4dd9ddba9d9bda6378fa79b2557932a1e817230476c88d9569"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/efe88a06696976cc3cebe1c32f87473147d0f479481023bd5c57017665a5c304"}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9852b20147873e4dd9ddba9d9bda6378fa79b2557932a1e817230476c88d9569","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"72eb677c53c76295736e11b471a01b2869d9c844a89b29feba51e447b05cf679","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b6b3d649c4e439a791518c6e78b6e1fd461a8e35b5c83e35c65852dc071b2ee6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"22deea6810ac900618063dc2353507ffadaaf2f0d0cd8a7911b44535e9dbf89b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db6fa2769fe37e466d1291aa29e31b5421243947cb3ef77ad1ca7dc48639d545","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e53ef4c04f4db89def5f6f77a5ce910fdc150b4c0841f81c45da75dcebad2adc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"efe88a06696976cc3cebe1c32f87473147d0f479481023bd5c57017665a5c304","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9852b20147873e4dd9ddba9d9bda6378fa79b2557932a1e817230476c88d9569","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-20T19:03:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9852b20147873e4dd9ddba9d9bda6378fa79b2557932a1e817230476c88d9569"}
{"level":"info","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54046","PortSpecifier":{"PortValue":54046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9ea34717-e937-4545-8d3e-7256c6fe716d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54046","PortSpecifier":{"PortValue":54046}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574206,"nanos":858344015},"http":{"id":"9ea34717-e937-4545-8d3e-7256c6fe716d","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f2325743-4cf2-41f9-84b4-dc7521b6e44a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d89baa54-ed10-48be-9bb0-75dd3e83a420"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/252d42704f07"]}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/252d42704f07"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d89baa54-ed10-48be-9bb0-75dd3e83a420"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f2325743-4cf2-41f9-84b4-dc7521b6e44a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f4795852c0a3f908ef7f986c8716c0ba7c789b8177b42bba53f2230185a28160"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ea34717-e937-4545-8d3e-7256c6fe716d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58992","PortSpecifier":{"PortValue":58992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-a2f866.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:58992","PortSpecifier":{"PortValue":58992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574206,"nanos":901686708},"http":{"id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","method":"POST","headers":{":authority":"e2e-shared-b-a2f866.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f2325743-4cf2-41f9-84b4-dc7521b6e44a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d89baa54-ed10-48be-9bb0-75dd3e83a420"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/252d42704f07"]}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/252d42704f07"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d89baa54-ed10-48be-9bb0-75dd3e83a420"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f2325743-4cf2-41f9-84b4-dc7521b6e44a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"efe88a06696976cc3cebe1c32f87473147d0f479481023bd5c57017665a5c304"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-a2f866.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a2f866/rate-test-model-a2f866\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-a2f866/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4c64394d-5d6a-4e0e-a997-6e83e29aa7e2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54058","PortSpecifier":{"PortValue":54058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a68b7028-5205-4111-8be0-8ea5c3596f24","method":"POST","path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54058","PortSpecifier":{"PortValue":54058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574206,"nanos":940896953},"http":{"id":"a68b7028-5205-4111-8be0-8ea5c3596f24","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF\"}"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","subscription":"e2e-rate-iso-a-b72210","tenant":"e2e-shared-a-b7bb94","userId":"73170f75-16cb-4e70-8eec-0d1e48519960","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\",\"requestedSubscription\":\"e2e-rate-iso-a-b72210\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b72210"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","selected_subscription":"e2e-rate-iso-a-b72210","selected_subscription_key":"ai-tenant-e2e-shared-a-b7bb94/e2e-rate-iso-a-b72210@ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a68b7028-5205-4111-8be0-8ea5c3596f24","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54072","PortSpecifier":{"PortValue":54072}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","method":"POST","path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54072","PortSpecifier":{"PortValue":54072}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574207,"nanos":995989610},"http":{"id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF"}
{"level":"debug","ts":"2026-07-20T19:03:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF\"}"}
{"level":"debug","ts":"2026-07-20T19:03:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","subscription":"e2e-rate-iso-a-b72210","tenant":"e2e-shared-a-b7bb94","userId":"73170f75-16cb-4e70-8eec-0d1e48519960","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\",\"requestedSubscription\":\"e2e-rate-iso-a-b72210\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"}}
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b72210"}
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","selected_subscription":"e2e-rate-iso-a-b72210","selected_subscription_key":"ai-tenant-e2e-shared-a-b7bb94/e2e-rate-iso-a-b72210@ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9080564-ea34-4e18-8ab2-5684c5cc7266","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54074","PortSpecifier":{"PortValue":54074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"358a5f04-774b-4c75-a715-78e3d5a3b087","method":"POST","path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54074","PortSpecifier":{"PortValue":54074}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574209,"nanos":37435968},"http":{"id":"358a5f04-774b-4c75-a715-78e3d5a3b087","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF"}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF\"}"}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","subscription":"e2e-rate-iso-a-b72210","tenant":"e2e-shared-a-b7bb94","userId":"73170f75-16cb-4e70-8eec-0d1e48519960","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\",\"requestedSubscription\":\"e2e-rate-iso-a-b72210\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"}}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b72210"}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","selected_subscription":"e2e-rate-iso-a-b72210","selected_subscription_key":"ai-tenant-e2e-shared-a-b7bb94/e2e-rate-iso-a-b72210@ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"358a5f04-774b-4c75-a715-78e3d5a3b087","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54088","PortSpecifier":{"PortValue":54088}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","method":"POST","path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:54088","PortSpecifier":{"PortValue":54088}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574210,"nanos":76103262},"http":{"id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF"}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF\"}"}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","subscription":"e2e-rate-iso-a-b72210","tenant":"e2e-shared-a-b7bb94","userId":"73170f75-16cb-4e70-8eec-0d1e48519960","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\",\"requestedSubscription\":\"e2e-rate-iso-a-b72210\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"}}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b72210"}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","selected_subscription":"e2e-rate-iso-a-b72210","selected_subscription_key":"ai-tenant-e2e-shared-a-b7bb94/e2e-rate-iso-a-b72210@ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"634aa9be-ff61-4ce0-8655-7ee24ec296a8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47966","PortSpecifier":{"PortValue":47966}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","method":"POST","path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47966","PortSpecifier":{"PortValue":47966}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574211,"nanos":112121113},"http":{"id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF"}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF\"}"}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","subscription":"e2e-rate-iso-a-b72210","tenant":"e2e-shared-a-b7bb94","userId":"73170f75-16cb-4e70-8eec-0d1e48519960","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\",\"requestedSubscription\":\"e2e-rate-iso-a-b72210\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"}}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b72210"}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","selected_subscription":"e2e-rate-iso-a-b72210","selected_subscription_key":"ai-tenant-e2e-shared-a-b7bb94/e2e-rate-iso-a-b72210@ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a85ce8f6-20b9-4c3b-baa0-ac1960b6baf7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47968","PortSpecifier":{"PortValue":47968}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","method":"POST","path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47968","PortSpecifier":{"PortValue":47968}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574212,"nanos":150246660},"http":{"id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF"}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF\"}"}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","subscription":"e2e-rate-iso-a-b72210","tenant":"e2e-shared-a-b7bb94","userId":"73170f75-16cb-4e70-8eec-0d1e48519960","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\",\"requestedSubscription\":\"e2e-rate-iso-a-b72210\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"}}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b72210"}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","selected_subscription":"e2e-rate-iso-a-b72210","selected_subscription_key":"ai-tenant-e2e-shared-a-b7bb94/e2e-rate-iso-a-b72210@ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54bc8f4f-30cb-4d50-b723-240ec1a124bc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47974","PortSpecifier":{"PortValue":47974}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","method":"POST","path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47974","PortSpecifier":{"PortValue":47974}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574213,"nanos":187748515},"http":{"id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF"}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF\"}"}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","subscription":"e2e-rate-iso-a-b72210","tenant":"e2e-shared-a-b7bb94","userId":"73170f75-16cb-4e70-8eec-0d1e48519960","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\",\"requestedSubscription\":\"e2e-rate-iso-a-b72210\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"}}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b72210"}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","selected_subscription":"e2e-rate-iso-a-b72210","selected_subscription_key":"ai-tenant-e2e-shared-a-b7bb94/e2e-rate-iso-a-b72210@ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0597ee08-0fb8-4e54-bce3-d5237f2ccd80","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"238adb4e-2946-4582-889e-99c21cc168fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47978","PortSpecifier":{"PortValue":47978}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"238adb4e-2946-4582-889e-99c21cc168fc","method":"POST","path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"238adb4e-2946-4582-889e-99c21cc168fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:47978","PortSpecifier":{"PortValue":47978}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574214,"nanos":227713550},"http":{"id":"238adb4e-2946-4582-889e-99c21cc168fc","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF"}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6Frk4n8fawf0DmAW_5THh7DfIxBZSyfFPSY8aAX43v14CTMs93Oil0LgCiQF\"}"}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","subscription":"e2e-rate-iso-a-b72210","tenant":"e2e-shared-a-b7bb94","userId":"73170f75-16cb-4e70-8eec-0d1e48519960","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\",\"requestedSubscription\":\"e2e-rate-iso-a-b72210\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"}}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"238adb4e-2946-4582-889e-99c21cc168fc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b72210"}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"238adb4e-2946-4582-889e-99c21cc168fc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"73170f75-16cb-4e70-8eec-0d1e48519960","keyName":"e2e-rate-a-b72210","selected_subscription":"e2e-rate-iso-a-b72210","selected_subscription_key":"ai-tenant-e2e-shared-a-b7bb94/e2e-rate-iso-a-b72210@ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b72210","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"238adb4e-2946-4582-889e-99c21cc168fc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"238adb4e-2946-4582-889e-99c21cc168fc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49326","PortSpecifier":{"PortValue":49326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e096c68-a024-410c-9eee-7e11f9205bb1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49326","PortSpecifier":{"PortValue":49326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574222,"nanos":959805818},"http":{"id":"4e096c68-a024-410c-9eee-7e11f9205bb1","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f2325743-4cf2-41f9-84b4-dc7521b6e44a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d89baa54-ed10-48be-9bb0-75dd3e83a420"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/252d42704f07"]}}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/252d42704f07"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d89baa54-ed10-48be-9bb0-75dd3e83a420"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f2325743-4cf2-41f9-84b4-dc7521b6e44a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f4795852c0a3f908ef7f986c8716c0ba7c789b8177b42bba53f2230185a28160"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.31:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e096c68-a024-410c-9eee-7e11f9205bb1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35542","PortSpecifier":{"PortValue":35542}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-a2f866.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35542","PortSpecifier":{"PortValue":35542}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574222,"nanos":993989672},"http":{"id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","method":"POST","headers":{":authority":"e2e-shared-b-a2f866.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"f2325743-4cf2-41f9-84b4-dc7521b6e44a","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d89baa54-ed10-48be-9bb0-75dd3e83a420"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/252d42704f07"]}}
{"level":"debug","ts":"2026-07-20T19:03:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/252d42704f07"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d89baa54-ed10-48be-9bb0-75dd3e83a420"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"f2325743-4cf2-41f9-84b4-dc7521b6e44a","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"efe88a06696976cc3cebe1c32f87473147d0f479481023bd5c57017665a5c304"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-a2f866.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a2f866/rate-test-model-a2f866\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-a2f866/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a071a0b-42fe-44e3-880d-13c35e066fbe","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"168cd5db-8473-4845-a839-c3460e727c9d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49342","PortSpecifier":{"PortValue":49342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"168cd5db-8473-4845-a839-c3460e727c9d","method":"POST","path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"168cd5db-8473-4845-a839-c3460e727c9d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49342","PortSpecifier":{"PortValue":49342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574223,"nanos":37852647},"http":{"id":"168cd5db-8473-4845-a839-c3460e727c9d","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-xcurH7OYRkPz7HhB_3BJEG6E4c2XPTboBhd1nQmI3Mmcr7lzQ8YJ5uXlPf4"}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-xcurH7OYRkPz7HhB_3BJEG6E4c2XPTboBhd1nQmI3Mmcr7lzQ8YJ5uXlPf4\"}"}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"07a57e99-9bda-43ad-8057-f7430b60e3f8","keyName":"e2e-rate-a-a499fc","subscription":"e2e-rate-iso-a-a499fc","tenant":"e2e-shared-a-b7bb94","userId":"07a57e99-9bda-43ad-8057-f7430b60e3f8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\",\"requestedSubscription\":\"e2e-rate-iso-a-a499fc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a499fc","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"}}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"168cd5db-8473-4845-a839-c3460e727c9d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a499fc"}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"168cd5db-8473-4845-a839-c3460e727c9d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"07a57e99-9bda-43ad-8057-f7430b60e3f8","keyName":"e2e-rate-a-a499fc","selected_subscription":"e2e-rate-iso-a-a499fc","selected_subscription_key":"ai-tenant-e2e-shared-a-b7bb94/e2e-rate-iso-a-a499fc@ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a499fc","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"168cd5db-8473-4845-a839-c3460e727c9d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"168cd5db-8473-4845-a839-c3460e727c9d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49344","PortSpecifier":{"PortValue":49344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","method":"POST","path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49344","PortSpecifier":{"PortValue":49344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574224,"nanos":97973490},"http":{"id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-xcurH7OYRkPz7HhB_3BJEG6E4c2XPTboBhd1nQmI3Mmcr7lzQ8YJ5uXlPf4"}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-xcurH7OYRkPz7HhB_3BJEG6E4c2XPTboBhd1nQmI3Mmcr7lzQ8YJ5uXlPf4\"}"}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"07a57e99-9bda-43ad-8057-f7430b60e3f8","keyName":"e2e-rate-a-a499fc","subscription":"e2e-rate-iso-a-a499fc","tenant":"e2e-shared-a-b7bb94","userId":"07a57e99-9bda-43ad-8057-f7430b60e3f8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\",\"requestedSubscription\":\"e2e-rate-iso-a-a499fc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a499fc","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"}}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a499fc"}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"07a57e99-9bda-43ad-8057-f7430b60e3f8","keyName":"e2e-rate-a-a499fc","selected_subscription":"e2e-rate-iso-a-a499fc","selected_subscription_key":"ai-tenant-e2e-shared-a-b7bb94/e2e-rate-iso-a-a499fc@ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a499fc","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33e6dc1a-528c-4625-a368-3390b9dc5e20","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49354","PortSpecifier":{"PortValue":49354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","method":"POST","path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions","host":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:49354","PortSpecifier":{"PortValue":49354}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.31:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574225,"nanos":139543047},"http":{"id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","method":"POST","headers":{":authority":"e2e-shared-a-b7bb94.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-xcurH7OYRkPz7HhB_3BJEG6E4c2XPTboBhd1nQmI3Mmcr7lzQ8YJ5uXlPf4"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-xcurH7OYRkPz7HhB_3BJEG6E4c2XPTboBhd1nQmI3Mmcr7lzQ8YJ5uXlPf4\"}"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"07a57e99-9bda-43ad-8057-f7430b60e3f8","keyName":"e2e-rate-a-a499fc","subscription":"e2e-rate-iso-a-a499fc","tenant":"e2e-shared-a-b7bb94","userId":"07a57e99-9bda-43ad-8057-f7430b60e3f8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\",\"requestedSubscription\":\"e2e-rate-iso-a-a499fc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-b7bb94.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a499fc","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-b7bb94/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a499fc"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"07a57e99-9bda-43ad-8057-f7430b60e3f8","keyName":"e2e-rate-a-a499fc","selected_subscription":"e2e-rate-iso-a-a499fc","selected_subscription_key":"ai-tenant-e2e-shared-a-b7bb94/e2e-rate-iso-a-a499fc@ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b7bb94","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a499fc","namespace":"ai-tenant-e2e-shared-a-b7bb94","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-b7bb94/rate-test-model-b7bb94"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"764b1cee-6224-4948-bf18-7e475bd3ad8d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35558","PortSpecifier":{"PortValue":35558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","method":"POST","path":"/ai-tenant-e2e-shared-b-a2f866/rate-test-model-a2f866/v1/completions","host":"e2e-shared-b-a2f866.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.12:35558","PortSpecifier":{"PortValue":35558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784574225,"nanos":180108036},"http":{"id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","method":"POST","headers":{":authority":"e2e-shared-b-a2f866.apps.de33a363-bfb5-483e-b00e-252d42704f07.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-a2f866/rate-test-model-a2f866/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-tlgAcwkMxzD17Agv_y9zq1T7dHTqMmiPPpMnCXFJThrMVUmw5tA0U5w02btd"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-a2f866.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-tlgAcwkMxzD17Agv_y9zq1T7dHTqMmiPPpMnCXFJThrMVUmw5tA0U5w02btd\"}"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-a2f866.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"4b5660a9-88b1-45ab-beee-a98bc8a44eca","keyName":"e2e-rate-b-a499fc","subscription":"e2e-rate-iso-b-a499fc","tenant":"e2e-shared-b-a2f866","userId":"4b5660a9-88b1-45ab-beee-a98bc8a44eca","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-a2f866.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-a2f866/rate-test-model-a2f866\",\"requestedSubscription\":\"e2e-rate-iso-b-a499fc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-a2f866.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-a2f866","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-a499fc","namespace":"ai-tenant-e2e-shared-b-a2f866","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-a2f866/rate-test-model-a2f866"}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-a2f866/rate-test-model-a2f866\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-a2f866/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-a499fc"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"4b5660a9-88b1-45ab-beee-a98bc8a44eca","keyName":"e2e-rate-b-a499fc","selected_subscription":"e2e-rate-iso-b-a499fc","selected_subscription_key":"ai-tenant-e2e-shared-b-a2f866/e2e-rate-iso-b-a499fc@ai-tenant-e2e-shared-b-a2f866/rate-test-model-a2f866","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-a2f866","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-a499fc","namespace":"ai-tenant-e2e-shared-b-a2f866","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-a2f866/rate-test-model-a2f866"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-20T19:03:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54486a0a-34cb-4349-91b9-4e7bbf7db63a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-20T19:03:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c01b04b19dc0651a482fd3add86118ac485d142002602c7df607636bb9022cc9"}
{"level":"info","ts":"2026-07-20T19:03:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a5739185beebcadcef1405b4615e2878df458c618db4c5f7ff6c04cf7c54b596"}
{"level":"info","ts":"2026-07-20T19:03:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2feb4ff2e1ad1e846cee14829fbf90d29b8db51eda421ec166aabbc0cbcaaa3c"}
{"level":"info","ts":"2026-07-20T19:03:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1d9ad652280ab832e4a0dfebf0a686a5d8c57f024d4139a9d9cba2d132e0f000"}
{"level":"info","ts":"2026-07-20T19:03:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b4af8d984e96cb5fcda6672a832ccdfb5a69c9439a47198cf13ef8f668dc2cef"}
{"level":"info","ts":"2026-07-20T19:03:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b6b3d649c4e439a791518c6e78b6e1fd461a8e35b5c83e35c65852dc071b2ee6"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9852b20147873e4dd9ddba9d9bda6378fa79b2557932a1e817230476c88d9569"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1085746e154fba428198607c0290b6f0959819b0b5c4b9e605c0614436381726"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3d78cea53b1596faacfde3123a7c45cbadfb73f56a89e3f2f8f3edd9eb3afc76"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/22deea6810ac900618063dc2353507ffadaaf2f0d0cd8a7911b44535e9dbf89b"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f4795852c0a3f908ef7f986c8716c0ba7c789b8177b42bba53f2230185a28160"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f7636d65ad2d8cbe931b98fb948fbcb800903dfcd809da7523dfec2ca2f4c05d"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9163b4e60a287ffa8c415cf0f00328890a9674190b6c4717ece762bbb85b3b64"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/72eb677c53c76295736e11b471a01b2869d9c844a89b29feba51e447b05cf679"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/45392c3d3825814dfda810b057c1182ef2e221f54afc848ebb6fda7e481ea6d8"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/db6fa2769fe37e466d1291aa29e31b5421243947cb3ef77ad1ca7dc48639d545"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/efe88a06696976cc3cebe1c32f87473147d0f479481023bd5c57017665a5c304"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/004f400717f6a55c52e418f0863e952cfdb35c7e408c453bf404b9184e4cd91f"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7cd53804955fc315a3d1c946a72df702f10876bc4636dfcdefff902479f1c28e"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/93b00fd211a8fc2572be0ae520e27e28e5fa24700a819f0ac6927657137f5b7d"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3b28c79c79ede9a5ad43c65e1fa3de97e58bc815f1c5f2409e0976e59eb93101"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3499548247a7cd35abe24269c369e01fe4f252fccf50fc8b1880044eb64b733f"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0de9302b34a9932f7543488bce2ce3b0911a58c1e34e6a9862aa029ad723677d"}
{"level":"info","ts":"2026-07-20T19:03:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e53ef4c04f4db89def5f6f77a5ce910fdc150b4c0841f81c45da75dcebad2adc"}