{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef6a6ac1853486c03591d26b90a8dc43f0ff423a52112c3072caa20375ee5de8"}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef6a6ac1853486c03591d26b90a8dc43f0ff423a52112c3072caa20375ee5de8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef6a6ac1853486c03591d26b90a8dc43f0ff423a52112c3072caa20375ee5de8"}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ef6a6ac1853486c03591d26b90a8dc43f0ff423a52112c3072caa20375ee5de8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ef6a6ac1853486c03591d26b90a8dc43f0ff423a52112c3072caa20375ee5de8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ef6a6ac1853486c03591d26b90a8dc43f0ff423a52112c3072caa20375ee5de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ef6a6ac1853486c03591d26b90a8dc43f0ff423a52112c3072caa20375ee5de8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ef6a6ac1853486c03591d26b90a8dc43f0ff423a52112c3072caa20375ee5de8"}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390"}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390"}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390"}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c"}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"}
{"level":"info","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:44Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:44Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"80338cfd35f735627c4b466ab6e22c136ba04b327d69eb4ab97947bb5802b655","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"80338cfd35f735627c4b466ab6e22c136ba04b327d69eb4ab97947bb5802b655","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80338cfd35f735627c4b466ab6e22c136ba04b327d69eb4ab97947bb5802b655"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"80338cfd35f735627c4b466ab6e22c136ba04b327d69eb4ab97947bb5802b655","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["80338cfd35f735627c4b466ab6e22c136ba04b327d69eb4ab97947bb5802b655"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"80338cfd35f735627c4b466ab6e22c136ba04b327d69eb4ab97947bb5802b655","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"80338cfd35f735627c4b466ab6e22c136ba04b327d69eb4ab97947bb5802b655","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/80338cfd35f735627c4b466ab6e22c136ba04b327d69eb4ab97947bb5802b655"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"38c53347c1e1da7460ad89e419a3b3dcb886e1da77a6b4882433daa750e6e0d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/38c53347c1e1da7460ad89e419a3b3dcb886e1da77a6b4882433daa750e6e0d3"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"38c53347c1e1da7460ad89e419a3b3dcb886e1da77a6b4882433daa750e6e0d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5ada7bce80f38886733dcaeed5caa97b34cc3ab849997db0dbdae2b7aa79887","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5ada7bce80f38886733dcaeed5caa97b34cc3ab849997db0dbdae2b7aa79887"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5ada7bce80f38886733dcaeed5caa97b34cc3ab849997db0dbdae2b7aa79887","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bb0b789438daa9e1010068c22458b1e3fa503c41675341645386107501991a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bb0b789438daa9e1010068c22458b1e3fa503c41675341645386107501991a2"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bb0b789438daa9e1010068c22458b1e3fa503c41675341645386107501991a2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/38c53347c1e1da7460ad89e419a3b3dcb886e1da77a6b4882433daa750e6e0d3"}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f9aec82b6f203bc0951441c5501ce31206f26428ed0a5398f63f32372200b492"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c03a81876f4336c9bfa1c56dc0fab4269c1393ee02259c06313f83d4efdd588"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"38c53347c1e1da7460ad89e419a3b3dcb886e1da77a6b4882433daa750e6e0d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["38c53347c1e1da7460ad89e419a3b3dcb886e1da77a6b4882433daa750e6e0d3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5ada7bce80f38886733dcaeed5caa97b34cc3ab849997db0dbdae2b7aa79887"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51adefb5d430d79dc44efc60aa97ee0f19023242fb7d3abb3e3c975f03c7eb50"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3057df86b9709e20414d1f627c0494e104835ecb80ab0f8a836c75dd8f64605c"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"38c53347c1e1da7460ad89e419a3b3dcb886e1da77a6b4882433daa750e6e0d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bb0b789438daa9e1010068c22458b1e3fa503c41675341645386107501991a2"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d23e683d10c0d33c30394d49c6cf3195e8968ae536719add70812004b5835df"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f9aec82b6f203bc0951441c5501ce31206f26428ed0a5398f63f32372200b492","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f9aec82b6f203bc0951441c5501ce31206f26428ed0a5398f63f32372200b492"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de888262180acf66a72cbe05a0c1ee84c49b92108203b222ac9b59cb79db7d41"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4ee092bfe0638421f6a13f57c9708839d8c966fdf2b65ebe2700359e05a8a7c"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f9aec82b6f203bc0951441c5501ce31206f26428ed0a5398f63f32372200b492","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c03a81876f4336c9bfa1c56dc0fab4269c1393ee02259c06313f83d4efdd588","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c03a81876f4336c9bfa1c56dc0fab4269c1393ee02259c06313f83d4efdd588"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c074cf0d9f895b28aaf22d6888808b4de1d5f111ba7f61b89afdc3b607ffc2b"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c03a81876f4336c9bfa1c56dc0fab4269c1393ee02259c06313f83d4efdd588","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5ada7bce80f38886733dcaeed5caa97b34cc3ab849997db0dbdae2b7aa79887","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5ada7bce80f38886733dcaeed5caa97b34cc3ab849997db0dbdae2b7aa79887"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/38c53347c1e1da7460ad89e419a3b3dcb886e1da77a6b4882433daa750e6e0d3"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f9aec82b6f203bc0951441c5501ce31206f26428ed0a5398f63f32372200b492"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5ada7bce80f38886733dcaeed5caa97b34cc3ab849997db0dbdae2b7aa79887","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51adefb5d430d79dc44efc60aa97ee0f19023242fb7d3abb3e3c975f03c7eb50","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["51adefb5d430d79dc44efc60aa97ee0f19023242fb7d3abb3e3c975f03c7eb50"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c03a81876f4336c9bfa1c56dc0fab4269c1393ee02259c06313f83d4efdd588"}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51adefb5d430d79dc44efc60aa97ee0f19023242fb7d3abb3e3c975f03c7eb50","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3057df86b9709e20414d1f627c0494e104835ecb80ab0f8a836c75dd8f64605c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:45Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3057df86b9709e20414d1f627c0494e104835ecb80ab0f8a836c75dd8f64605c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5ada7bce80f38886733dcaeed5caa97b34cc3ab849997db0dbdae2b7aa79887"}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3057df86b9709e20414d1f627c0494e104835ecb80ab0f8a836c75dd8f64605c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2bb0b789438daa9e1010068c22458b1e3fa503c41675341645386107501991a2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2bb0b789438daa9e1010068c22458b1e3fa503c41675341645386107501991a2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51adefb5d430d79dc44efc60aa97ee0f19023242fb7d3abb3e3c975f03c7eb50"}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3057df86b9709e20414d1f627c0494e104835ecb80ab0f8a836c75dd8f64605c"}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2bb0b789438daa9e1010068c22458b1e3fa503c41675341645386107501991a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3d23e683d10c0d33c30394d49c6cf3195e8968ae536719add70812004b5835df","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3d23e683d10c0d33c30394d49c6cf3195e8968ae536719add70812004b5835df"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2bb0b789438daa9e1010068c22458b1e3fa503c41675341645386107501991a2"}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3d23e683d10c0d33c30394d49c6cf3195e8968ae536719add70812004b5835df","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"de888262180acf66a72cbe05a0c1ee84c49b92108203b222ac9b59cb79db7d41","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["de888262180acf66a72cbe05a0c1ee84c49b92108203b222ac9b59cb79db7d41"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3d23e683d10c0d33c30394d49c6cf3195e8968ae536719add70812004b5835df"}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"de888262180acf66a72cbe05a0c1ee84c49b92108203b222ac9b59cb79db7d41","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a4ee092bfe0638421f6a13f57c9708839d8c966fdf2b65ebe2700359e05a8a7c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a4ee092bfe0638421f6a13f57c9708839d8c966fdf2b65ebe2700359e05a8a7c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/de888262180acf66a72cbe05a0c1ee84c49b92108203b222ac9b59cb79db7d41"}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a4ee092bfe0638421f6a13f57c9708839d8c966fdf2b65ebe2700359e05a8a7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1c074cf0d9f895b28aaf22d6888808b4de1d5f111ba7f61b89afdc3b607ffc2b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1c074cf0d9f895b28aaf22d6888808b4de1d5f111ba7f61b89afdc3b607ffc2b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a4ee092bfe0638421f6a13f57c9708839d8c966fdf2b65ebe2700359e05a8a7c"}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1c074cf0d9f895b28aaf22d6888808b4de1d5f111ba7f61b89afdc3b607ffc2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c074cf0d9f895b28aaf22d6888808b4de1d5f111ba7f61b89afdc3b607ffc2b"}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"38c53347c1e1da7460ad89e419a3b3dcb886e1da77a6b4882433daa750e6e0d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f9aec82b6f203bc0951441c5501ce31206f26428ed0a5398f63f32372200b492","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c03a81876f4336c9bfa1c56dc0fab4269c1393ee02259c06313f83d4efdd588","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5ada7bce80f38886733dcaeed5caa97b34cc3ab849997db0dbdae2b7aa79887","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51adefb5d430d79dc44efc60aa97ee0f19023242fb7d3abb3e3c975f03c7eb50","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3057df86b9709e20414d1f627c0494e104835ecb80ab0f8a836c75dd8f64605c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2bb0b789438daa9e1010068c22458b1e3fa503c41675341645386107501991a2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3d23e683d10c0d33c30394d49c6cf3195e8968ae536719add70812004b5835df","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"de888262180acf66a72cbe05a0c1ee84c49b92108203b222ac9b59cb79db7d41","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a4ee092bfe0638421f6a13f57c9708839d8c966fdf2b65ebe2700359e05a8a7c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c074cf0d9f895b28aaf22d6888808b4de1d5f111ba7f61b89afdc3b607ffc2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9"}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9"}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T03:42:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9"}
{"level":"error","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T03:42:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6667182-8434-4a2a-898d-9725bc136001","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:51832","PortSpecifier":{"PortValue":51832}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a6667182-8434-4a2a-898d-9725bc136001","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6667182-8434-4a2a-898d-9725bc136001","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:51832","PortSpecifier":{"PortValue":51832}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691770,"nanos":857863957},"http":{"id":"a6667182-8434-4a2a-898d-9725bc136001","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a6667182-8434-4a2a-898d-9725bc136001","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a6667182-8434-4a2a-898d-9725bc136001","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0c970c12-f680-4c3b-8d8b-2fbdb5d0c826","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d085c3e5-0159-4e5b-8e92-50e0181da8da"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/36514607a2a5"]}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a6667182-8434-4a2a-898d-9725bc136001","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/36514607a2a5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d085c3e5-0159-4e5b-8e92-50e0181da8da"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0c970c12-f680-4c3b-8d8b-2fbdb5d0c826","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6667182-8434-4a2a-898d-9725bc136001","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6667182-8434-4a2a-898d-9725bc136001","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6667182-8434-4a2a-898d-9725bc136001","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a6667182-8434-4a2a-898d-9725bc136001","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6667182-8434-4a2a-898d-9725bc136001","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6667182-8434-4a2a-898d-9725bc136001","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6667182-8434-4a2a-898d-9725bc136001","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6667182-8434-4a2a-898d-9725bc136001","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59984","PortSpecifier":{"PortValue":59984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5ce968c0-9120-44ad-99b6-995a3950efac","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-49462a.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59984","PortSpecifier":{"PortValue":59984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691770,"nanos":901744527},"http":{"id":"5ce968c0-9120-44ad-99b6-995a3950efac","method":"POST","headers":{":authority":"e2e-shared-b-49462a.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0c970c12-f680-4c3b-8d8b-2fbdb5d0c826","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d085c3e5-0159-4e5b-8e92-50e0181da8da"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/36514607a2a5"]}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/36514607a2a5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d085c3e5-0159-4e5b-8e92-50e0181da8da"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0c970c12-f680-4c3b-8d8b-2fbdb5d0c826","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-49462a.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-49462a/rate-test-model-49462a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-49462a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5ce968c0-9120-44ad-99b6-995a3950efac","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:51844","PortSpecifier":{"PortValue":51844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","method":"POST","path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:51844","PortSpecifier":{"PortValue":51844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691770,"nanos":945215059},"http":{"id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G\"}"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","subscription":"e2e-rate-iso-a-772c0a","tenant":"e2e-shared-a-c19e4b","userId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\",\"requestedSubscription\":\"e2e-rate-iso-a-772c0a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-772c0a"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","selected_subscription":"e2e-rate-iso-a-772c0a","selected_subscription_key":"ai-tenant-e2e-shared-a-c19e4b/e2e-rate-iso-a-772c0a@ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:42:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"29adeb23-e396-4dfa-9a44-891f92a88ce7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:51858","PortSpecifier":{"PortValue":51858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","method":"POST","path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:51858","PortSpecifier":{"PortValue":51858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691772,"nanos":5947568},"http":{"id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G"}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G\"}"}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","subscription":"e2e-rate-iso-a-772c0a","tenant":"e2e-shared-a-c19e4b","userId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\",\"requestedSubscription\":\"e2e-rate-iso-a-772c0a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"}}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-772c0a"}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","selected_subscription":"e2e-rate-iso-a-772c0a","selected_subscription_key":"ai-tenant-e2e-shared-a-c19e4b/e2e-rate-iso-a-772c0a@ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:42:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb9da03b-951a-4c55-8013-7c9d9f2eb27d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:51862","PortSpecifier":{"PortValue":51862}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","method":"POST","path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:51862","PortSpecifier":{"PortValue":51862}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691773,"nanos":51910594},"http":{"id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G"}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G\"}"}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","subscription":"e2e-rate-iso-a-772c0a","tenant":"e2e-shared-a-c19e4b","userId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\",\"requestedSubscription\":\"e2e-rate-iso-a-772c0a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"}}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-772c0a"}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","selected_subscription":"e2e-rate-iso-a-772c0a","selected_subscription_key":"ai-tenant-e2e-shared-a-c19e4b/e2e-rate-iso-a-772c0a@ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:42:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2166da7e-d510-4a47-a21d-c1f29ad5d28a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:51874","PortSpecifier":{"PortValue":51874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","method":"POST","path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:51874","PortSpecifier":{"PortValue":51874}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691774,"nanos":92937360},"http":{"id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G"}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G\"}"}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","subscription":"e2e-rate-iso-a-772c0a","tenant":"e2e-shared-a-c19e4b","userId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\",\"requestedSubscription\":\"e2e-rate-iso-a-772c0a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"}}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-772c0a"}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","selected_subscription":"e2e-rate-iso-a-772c0a","selected_subscription_key":"ai-tenant-e2e-shared-a-c19e4b/e2e-rate-iso-a-772c0a@ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:42:54Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31b27176-57be-4bfb-a7be-e0ab0b01dd1f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55498","PortSpecifier":{"PortValue":55498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8245867b-402f-47a2-b5e5-26d0f5d19497","method":"POST","path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55498","PortSpecifier":{"PortValue":55498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691775,"nanos":132092678},"http":{"id":"8245867b-402f-47a2-b5e5-26d0f5d19497","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G"}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G\"}"}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","subscription":"e2e-rate-iso-a-772c0a","tenant":"e2e-shared-a-c19e4b","userId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\",\"requestedSubscription\":\"e2e-rate-iso-a-772c0a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"}}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-772c0a"}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","selected_subscription":"e2e-rate-iso-a-772c0a","selected_subscription_key":"ai-tenant-e2e-shared-a-c19e4b/e2e-rate-iso-a-772c0a@ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:42:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8245867b-402f-47a2-b5e5-26d0f5d19497","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55502","PortSpecifier":{"PortValue":55502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","method":"POST","path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55502","PortSpecifier":{"PortValue":55502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691776,"nanos":175797914},"http":{"id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G"}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G\"}"}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","subscription":"e2e-rate-iso-a-772c0a","tenant":"e2e-shared-a-c19e4b","userId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\",\"requestedSubscription\":\"e2e-rate-iso-a-772c0a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"}}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-772c0a"}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","selected_subscription":"e2e-rate-iso-a-772c0a","selected_subscription_key":"ai-tenant-e2e-shared-a-c19e4b/e2e-rate-iso-a-772c0a@ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:42:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c5e0a303-9a7e-4751-89bd-bc85f618cdb0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55506","PortSpecifier":{"PortValue":55506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","method":"POST","path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55506","PortSpecifier":{"PortValue":55506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691777,"nanos":215770826},"http":{"id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G"}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G\"}"}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","subscription":"e2e-rate-iso-a-772c0a","tenant":"e2e-shared-a-c19e4b","userId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\",\"requestedSubscription\":\"e2e-rate-iso-a-772c0a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"}}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-772c0a"}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","selected_subscription":"e2e-rate-iso-a-772c0a","selected_subscription_key":"ai-tenant-e2e-shared-a-c19e4b/e2e-rate-iso-a-772c0a@ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:42:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"343cfebd-63ce-41ee-a8fb-f88557b5f2b5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55522","PortSpecifier":{"PortValue":55522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"56f25733-e29d-4d53-8605-75c32b65eb17","method":"POST","path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:55522","PortSpecifier":{"PortValue":55522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691778,"nanos":256055577},"http":{"id":"56f25733-e29d-4d53-8605-75c32b65eb17","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G"}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GPlpa7INDAyuY34M_MsSKpOtsQogMOpoI3V1RcMyd4YfiL4SbWsGi8OsII1G\"}"}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","subscription":"e2e-rate-iso-a-772c0a","tenant":"e2e-shared-a-c19e4b","userId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\",\"requestedSubscription\":\"e2e-rate-iso-a-772c0a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"}}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-772c0a"}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b63fb306-44d2-482f-97fd-8321b1a9a0d9","keyName":"e2e-rate-a-772c0a","selected_subscription":"e2e-rate-iso-a-772c0a","selected_subscription_key":"ai-tenant-e2e-shared-a-c19e4b/e2e-rate-iso-a-772c0a@ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-772c0a","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:42:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56f25733-e29d-4d53-8605-75c32b65eb17","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46428","PortSpecifier":{"PortValue":46428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46428","PortSpecifier":{"PortValue":46428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691787,"nanos":118481770},"http":{"id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0c970c12-f680-4c3b-8d8b-2fbdb5d0c826","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d085c3e5-0159-4e5b-8e92-50e0181da8da"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/36514607a2a5"]}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/36514607a2a5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d085c3e5-0159-4e5b-8e92-50e0181da8da"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0c970c12-f680-4c3b-8d8b-2fbdb5d0c826","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.47:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d6dd9cc-e2ce-49f7-8521-728d1aaaceb6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:32868","PortSpecifier":{"PortValue":32868}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-49462a.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:32868","PortSpecifier":{"PortValue":32868}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691787,"nanos":156899145},"http":{"id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","method":"POST","headers":{":authority":"e2e-shared-b-49462a.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0c970c12-f680-4c3b-8d8b-2fbdb5d0c826","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d085c3e5-0159-4e5b-8e92-50e0181da8da"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/36514607a2a5"]}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/36514607a2a5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d085c3e5-0159-4e5b-8e92-50e0181da8da"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0c970c12-f680-4c3b-8d8b-2fbdb5d0c826","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-49462a.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-49462a/rate-test-model-49462a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-49462a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ccd2587e-ca6a-4948-a11d-1881cf78f85e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"552900a3-a9a1-40de-a299-20d12735540a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46432","PortSpecifier":{"PortValue":46432}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"552900a3-a9a1-40de-a299-20d12735540a","method":"POST","path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"552900a3-a9a1-40de-a299-20d12735540a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46432","PortSpecifier":{"PortValue":46432}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691787,"nanos":195371665},"http":{"id":"552900a3-a9a1-40de-a299-20d12735540a","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sQwH2J7hWDD0K8ji_yZA5jQgSopKvwllqAfIz2utFeNMLU6icbkHbwEFJOpt"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sQwH2J7hWDD0K8ji_yZA5jQgSopKvwllqAfIz2utFeNMLU6icbkHbwEFJOpt\"}"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2fefcbf8-8bdb-4d85-bed1-1ca528371cc4","keyName":"e2e-rate-a-b18cc6","subscription":"e2e-rate-iso-a-b18cc6","tenant":"e2e-shared-a-c19e4b","userId":"2fefcbf8-8bdb-4d85-bed1-1ca528371cc4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\",\"requestedSubscription\":\"e2e-rate-iso-a-b18cc6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b18cc6","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"552900a3-a9a1-40de-a299-20d12735540a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b18cc6"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"552900a3-a9a1-40de-a299-20d12735540a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2fefcbf8-8bdb-4d85-bed1-1ca528371cc4","keyName":"e2e-rate-a-b18cc6","selected_subscription":"e2e-rate-iso-a-b18cc6","selected_subscription_key":"ai-tenant-e2e-shared-a-c19e4b/e2e-rate-iso-a-b18cc6@ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b18cc6","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"552900a3-a9a1-40de-a299-20d12735540a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:43:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"552900a3-a9a1-40de-a299-20d12735540a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46448","PortSpecifier":{"PortValue":46448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9a16e806-9959-4bcb-8921-04662b98ccd6","method":"POST","path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46448","PortSpecifier":{"PortValue":46448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691788,"nanos":236445408},"http":{"id":"9a16e806-9959-4bcb-8921-04662b98ccd6","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sQwH2J7hWDD0K8ji_yZA5jQgSopKvwllqAfIz2utFeNMLU6icbkHbwEFJOpt"}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sQwH2J7hWDD0K8ji_yZA5jQgSopKvwllqAfIz2utFeNMLU6icbkHbwEFJOpt\"}"}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2fefcbf8-8bdb-4d85-bed1-1ca528371cc4","keyName":"e2e-rate-a-b18cc6","subscription":"e2e-rate-iso-a-b18cc6","tenant":"e2e-shared-a-c19e4b","userId":"2fefcbf8-8bdb-4d85-bed1-1ca528371cc4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\",\"requestedSubscription\":\"e2e-rate-iso-a-b18cc6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b18cc6","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"}}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b18cc6"}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2fefcbf8-8bdb-4d85-bed1-1ca528371cc4","keyName":"e2e-rate-a-b18cc6","selected_subscription":"e2e-rate-iso-a-b18cc6","selected_subscription_key":"ai-tenant-e2e-shared-a-c19e4b/e2e-rate-iso-a-b18cc6@ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b18cc6","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:43:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9a16e806-9959-4bcb-8921-04662b98ccd6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46454","PortSpecifier":{"PortValue":46454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","method":"POST","path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions","host":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:46454","PortSpecifier":{"PortValue":46454}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.47:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691789,"nanos":273014808},"http":{"id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","method":"POST","headers":{":authority":"e2e-shared-a-c19e4b.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sQwH2J7hWDD0K8ji_yZA5jQgSopKvwllqAfIz2utFeNMLU6icbkHbwEFJOpt"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sQwH2J7hWDD0K8ji_yZA5jQgSopKvwllqAfIz2utFeNMLU6icbkHbwEFJOpt\"}"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2fefcbf8-8bdb-4d85-bed1-1ca528371cc4","keyName":"e2e-rate-a-b18cc6","subscription":"e2e-rate-iso-a-b18cc6","tenant":"e2e-shared-a-c19e4b","userId":"2fefcbf8-8bdb-4d85-bed1-1ca528371cc4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\",\"requestedSubscription\":\"e2e-rate-iso-a-b18cc6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-c19e4b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b18cc6","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-c19e4b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b18cc6"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2fefcbf8-8bdb-4d85-bed1-1ca528371cc4","keyName":"e2e-rate-a-b18cc6","selected_subscription":"e2e-rate-iso-a-b18cc6","selected_subscription_key":"ai-tenant-e2e-shared-a-c19e4b/e2e-rate-iso-a-b18cc6@ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-c19e4b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b18cc6","namespace":"ai-tenant-e2e-shared-a-c19e4b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-c19e4b/rate-test-model-c19e4b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8488b56b-0db8-47b4-a966-b4aeaa30762f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"617e90fb-df44-49a0-a40b-27d443680275","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:32880","PortSpecifier":{"PortValue":32880}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"617e90fb-df44-49a0-a40b-27d443680275","method":"POST","path":"/ai-tenant-e2e-shared-b-49462a/rate-test-model-49462a/v1/completions","host":"e2e-shared-b-49462a.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"617e90fb-df44-49a0-a40b-27d443680275","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:32880","PortSpecifier":{"PortValue":32880}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784691789,"nanos":310455376},"http":{"id":"617e90fb-df44-49a0-a40b-27d443680275","method":"POST","headers":{":authority":"e2e-shared-b-49462a.apps.03ef608a-8688-4dc4-a5e2-36514607a2a5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-49462a/rate-test-model-49462a/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-78RKleHOR9w50ODz_C9bG8ZTw7cJOdq9e7KUiWSkF5AXQPyj2QnUaaW5Qggd"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-49462a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-78RKleHOR9w50ODz_C9bG8ZTw7cJOdq9e7KUiWSkF5AXQPyj2QnUaaW5Qggd\"}"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-49462a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ba3e46cf-bcaf-4f29-8ce3-f37fcfe8f22d","keyName":"e2e-rate-b-b18cc6","subscription":"e2e-rate-iso-b-b18cc6","tenant":"e2e-shared-b-49462a","userId":"ba3e46cf-bcaf-4f29-8ce3-f37fcfe8f22d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-49462a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-49462a/rate-test-model-49462a\",\"requestedSubscription\":\"e2e-rate-iso-b-b18cc6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-49462a.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-49462a","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-b18cc6","namespace":"ai-tenant-e2e-shared-b-49462a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-49462a/rate-test-model-49462a"}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"617e90fb-df44-49a0-a40b-27d443680275","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-49462a/rate-test-model-49462a\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-49462a/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-b18cc6"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"617e90fb-df44-49a0-a40b-27d443680275","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ba3e46cf-bcaf-4f29-8ce3-f37fcfe8f22d","keyName":"e2e-rate-b-b18cc6","selected_subscription":"e2e-rate-iso-b-b18cc6","selected_subscription_key":"ai-tenant-e2e-shared-b-49462a/e2e-rate-iso-b-b18cc6@ai-tenant-e2e-shared-b-49462a/rate-test-model-49462a","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-49462a","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-b18cc6","namespace":"ai-tenant-e2e-shared-b-49462a","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-49462a/rate-test-model-49462a"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"617e90fb-df44-49a0-a40b-27d443680275","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T03:43:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"617e90fb-df44-49a0-a40b-27d443680275","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T03:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1c074cf0d9f895b28aaf22d6888808b4de1d5f111ba7f61b89afdc3b607ffc2b"}
{"level":"info","ts":"2026-07-22T03:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2c03a81876f4336c9bfa1c56dc0fab4269c1393ee02259c06313f83d4efdd588"}
{"level":"info","ts":"2026-07-22T03:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e5ada7bce80f38886733dcaeed5caa97b34cc3ab849997db0dbdae2b7aa79887"}
{"level":"info","ts":"2026-07-22T03:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2cb489a50ed14b72f668e650c0b5e479f4674d5244e280ba24f6c30722d38549"}
{"level":"info","ts":"2026-07-22T03:43:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b45be70dd45113a55f2a2e6147eeb3f0a5f878fae01f0be7ad83d77aeb4e1a9"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/51adefb5d430d79dc44efc60aa97ee0f19023242fb7d3abb3e3c975f03c7eb50"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7744f835ef7f97d0c2d17a4de6d3fb148ac337162c32236464e5db08d576dcb9"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2aae19561f993522a8387dfc749c2690a2f2d12c643eb8f47fe50357c40dbe47"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a4ee092bfe0638421f6a13f57c9708839d8c966fdf2b65ebe2700359e05a8a7c"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a3fe09ada65b5e2d602ec6b3505624cce986e4c605cc70bf4696999e449ae87f"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/de888262180acf66a72cbe05a0c1ee84c49b92108203b222ac9b59cb79db7d41"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8cfa12454d53eb5f3baf6e774220b711fb38638d6984b5c1af0e86d5aaf5ce3c"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/38c53347c1e1da7460ad89e419a3b3dcb886e1da77a6b4882433daa750e6e0d3"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6146eb60986a45508951e86a55f0e76c8b02464c2990e3f17fe3d20aae996390"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1378d872a344b5583de658fb21fc1b65776b447916e7406fddc2e0bee31cc603"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3d23e683d10c0d33c30394d49c6cf3195e8968ae536719add70812004b5835df"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/12ae599ae0e3a3266d6c2197e1a2d78739af89f32598de1b8bb8fe2d398fc7a9"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c84028799cbe4e0b5813d615efb32e5fc1b60108beedcf91e99fbf07e9390738"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/74165cc3d5f289210788205601ce9a86fccec81b7b1f0bb4a7e4786f26ccce42"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ef6a6ac1853486c03591d26b90a8dc43f0ff423a52112c3072caa20375ee5de8"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2bb0b789438daa9e1010068c22458b1e3fa503c41675341645386107501991a2"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/80338cfd35f735627c4b466ab6e22c136ba04b327d69eb4ab97947bb5802b655"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3057df86b9709e20414d1f627c0494e104835ecb80ab0f8a836c75dd8f64605c"}
{"level":"info","ts":"2026-07-22T03:43:15Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f9aec82b6f203bc0951441c5501ce31206f26428ed0a5398f63f32372200b492"}